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Nomenclature 


APD 

AREC 

CADS 

FPB , . . . 

Aerojet Propulsion Division 

Aerojet’s Advanced Rocket Engine Controller 

Command and Data Simulator 

Fuel Prebumer 

HPFP 

HPFT 

HPOP 

HPOT 

JSC 

T^pr 

High Pressure Fuel Pump 

High Pressure Fuel Turbine 

High Pressure Oxidizer Pump 

High Pressure Oxidizer Turbine 

Johnson Space Center 

LOX 

Liquid Oxygen 

MCC 

MSFC 

MTBF 

PID 

PBP 

PC . . . . 

Main Combustion Chamber 

Marshall Space Flight Center 

Mean Time Between Failure 

Parameter ID (Sensor Identification Number) 

Prebumer Boost Pump 

Chamber Pressure 

SDV ....... 

Sensor Data Validation 

s SC ....... 

- Stennis Space Center 

SSME 

T TP 

Space Shuttle Main Engine 

Technology Test Bed 

TTBE 

Technology Test Bed Engine 
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Summary 


This report describes the status of an on-going effort by the NASA Lewis Research Center 
and Aerojet Propulsion Division to develop software capable of detecting sensor failures on 
liquid rocket engines in real time, and with a high degree of confidence. This software 
could be used in a rocket engine controller to prevent the erroneous shutdown of an engine 
due to sensor failures which would otherwise be interpreted as engine failures by the 
control software. 

The approach taken combines analytic redundancy with Bayesian belief networks to 
provide a solution which has well-defined real-time characteristics, well-defined error rates, 
and is scaleable to validate any number of engine sensors. Analytical redundancy is a 
technique in which a sensor's value is predicted by using values from other, usually non- 
redundant, sensors and known or empirically derived mathematical relations. Tor example, 
given the engine plant diagram in Figure 1, fuel flow can be related to either the low 
pressure pump speed or the high pressure pump speed by a pump affinity equation 
(assuming constant fuel density). As shown, a set of sensors and a set relationships among 
them form a network of cross-checks which can be used to periodically validate all of the 
sensors in the networks Bayesian belief networks provide a mathematically sound method 
of determining if each of tire sensors in the network is valid, given the results of all of these 
cross-checks. 



Figure 1. Example Engine Plant Diagram and 
Partial Sensor Validation Network 


This approach has been codified in an algorithm which has been successfully demonstrated 
on a rocket engine controller in real-time on the Technology Test Bed Engine at the NASA 
Marshall Space Flight Center. Current efforts are focused on extending die demonstration 
system to provide a real-time validation capability for approximately 100 sensors on the 
Space Shuttle Main Engine. 
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The safety and reliability of rocket engines would be enhanced if engine controllers and 
advanced safety systems could determine if sensors were supplying faulty data. This 
ability, termed sensor data validation, could prevent the controller or safety system from 
making critical decisions, such as the decision to shut an engine down, on the basis of data 
from anomalous or failed sensors. 


An approach to validating sensors in real-time has been developed and demonstrated on the 
Technology Test Bed Engine (TTBE) at the NASA Marshall Space Flight Center (MSFQ. 
The demonstration system validated six channels of sensor data in real-time, running on a 
state-of-the-art engine controller. 


The current effort involves extending the demonstration system in the following ways: 

• The number of sensors validated will be increased from six to approximately 97. 

• The system will monitor continuously during mainstage (the First demonstration 
system only operated during steady-state intervals). 

• Hard failures in control and realine sensors will be detected before the engine 


controller responds. ... 

• As an option, the system will monitor control and redline sensors during the engine 

startup transient _ _ , 

The extended system will be implemented on a 486PC in the Technology Test Bed (TIB) 
blockhouse which receives data in real-time during TTBE firings. The completed system 
will be validated on at least 20 engine firings. 


This report describes the status of an on-going effort by the NASA Lewis Research Center 
(LeRC) and Aerojet Propulsion Division (APD) to develop a software solution to the 
sensor data validation problem capable of running in a ground test computer or rocket 
engine controller. A program plan is then presented in detail for continuation of this work 
by Aerojet in FY93-FY95 on the Real-Time Sensor Data Validation task of the 
Development of Life Prediction Capabilities for Liquid Propulsion Rocket Engines 
contract. This project is being funded by the NASA OACT ETO program. 


Efforts to develop an approach to real-time sensor data validation (SDV) for liquid rocket 
engines have evolved over four years (see Figure 2), from conceptual design (FY90) to 
software implementation and test in a rocket engine controller on the TTB test stand 
(FY92). More recent efforts have focused on scaling up the capability demonstrated on 
TTB to validate the majority of control and health monitoring sensors on the Space Shuttle 
Main Engine (SSME). 


ILL System Architecture Stiidl . , 

In FY90 a System Architecture Study of SDV was performed by Aerojet which reviewed 
common sensor failure modes on the SSME, the data validation process used by SSME 
data analysts at MSFC, and a number of alternative approaches to automating SDV for 

post-test/post-flight data analysis. 1 


The approaches to SDV reviewed included range and rate limit checking 2 *^, various 
pattern-matching techniques'"^, and analytical redundancy 1 0-12. The conclusion of this 
study was that no single algorithmic method should be used for SDV; rather several 
methods should be used to analyze sensor data and the results integrated or “fused” into a 
final conclusion regarding the integrity of each sensor. Several approaches to information 
fusion were also reviewed for their applicability to SDV, including binary logic, ad-hoc 
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Figure 2. Real-Time Sensor Data Validation Program History 


certainty factors 13 , Dempster-Shafer theory 14 , and Bayesian belief networks 15 . 
Bayesian belief networks were selected as the best strategy, since they were believed to be 
die most mathematically sound approach to information fusion. 

n.2. Probabilistic Appr oach to Analytical Redundancy . 

Real- time sensor data validation was targeted as a demonstration application for APD s 
Advanced Rocket Engine Controller (AREC), developed on APD's Integrated Controls and 
Health Management IR&D in FY91 (Project AMP91-03). The approach taken combined 
analytical redundancy with Bayesian information fusion techniques to achieve a solution 
which has well-understood false alarm and missed detection error rates, operates within 
hard tiny. constraints, and is scaleable to validate any number of sensors. 1 6 

Analytical redundancy is a technique in which a sensor's value is protected by using 
values from other, usually non-redundant, sensors and known or empirically derived 
relations among the sensor values. For example, Figure 3 shows a relation among three 
sensor values using a standard formula for fluid line resistance. Relations can also be 
empirically derived using standard statistical regression techniques. The simplest form of 
these empirical relations is a linear equation relating two sensor values, as shown in Hgure 
4. In general, a relation is used to provide validation information for all related sensors. 
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Figure 3. Example Characteristic Relation 



Figure 4. Example Statistical Relation 


A group of sensors and a set of relations among them define a network. Figure 5 shows a 
very simple example of a sensor validation network for three parameters cm the SSME. 

The difference between a value predicted using a relation and a directly sensed value is 
called a residual, and is a measure of the quality of the relation, given that the sensors 
involved are known to be working properly. In die approach taken in this work, one or 
more algebraic relations are defined for every sensor in the network which relate its value to 
the values of one or more other sensors in the network. The mean and standard deviation 
of the relation residuals (evaluated cm normal engine test firing data) are also computed. 




Figure 5. Example Sensor Validation Network 








Given this information, a validation algorithm could sample sensor values every controller 
cycle during an engine firing and determine if each of the relations holds or not by 
thresholding on a particular residual, such as three standard deviations. Once the status of 
every relation in the network has been determined to either “hold” or “not hold”, the 
validation algorithm makes a conclusion about the validity of each sensor in the network 
(the one-cycle decision problem). Conclusions made during several consecutive controller 
cycles may be fused together in order to disqualify a sensor (the multi-cycle decision 
problem). Figure 6 summarizes this overall approach. 


Start of 
ControDer 
Cyde 



Qualification 

Figure 6. Overall Approach to Real-Time Sensor Data Validation 

Before this general approach could be implemented, several questions needed to be 
answered: 

• How many relations are needed to validate a sensor? 

• How many of a sensor's relations need to hold in order to validate the sensor during 
one controller cycle? 

• What threshold should be used on the individual relation residual tests? 

• Should sensor value averaging or other multi-cycle strategies be used? 

• Can a scaleable approach to validation be developed which will work with any 
number of sensors? 

• Do all relations need to be evaluated every cycle to validate all sensors? 

Bavesian Analysis 

Bayesian probability theory provides a formal framework within which the questions posed 
above can be answered. Bayesian probability theory provides a mathematically sound 
approach to the problem of information fusion — die combination of evidence from 
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several sources into a single, consistent model. In information fusion, uncertainties in the 
sources of evidence (i.e., inaccuracies in the sensors or uncertainties in the fault detection 
algorithms themselves) are explicitly modeled and accounted for. 

A Bayesian Belief Network is a graphical representation of a joint probability distribution 
of a set of random variables. 15 ’* 7 ’ 18 As an example, the validation network shown in 
Figure 5 can be represented as the Belief Network shown in Figure 7. In this network, the 
nodes SI, S2, and S3 represent the status of the respective sensors (i.e. whether they are 
working or not), while the nodes Rl, R2, and R3 represent whether an analytical 
redundancy relationship currently holds between the sensors or not. Connections in the 
network represent influences between variables. In Figure 5, for example, a failure in 
sensor S 1 would influence the expected probability distribution on the status of relation 

Rl. 



Figure 7. Example Sensor Validation Network Cast into a Bayesian Belief 

Network for Analysis 


Given the Belief Network shown in Figure 7, the probability of each sensor being valid 
given the current status of all relations can be derived. These equations can then be used to 
answer the questions posed above, and to develop a mathematically sound approach to 
sensor data validation. 


The following assumptions were made in the FY91 activity in order to conduct the 

Bayesian analysis: . ....... 

• Although several sensors may fail during a firing, two sensors cannot fail during a 
single controller cycle. The likelihood of two or more sensors initiating a failure at 
the same instant in time is very remote, and it would greatly complicate the validation 

system to accommodate such simultaneous multiple-point failures. 

• Once a sensor is determined to have failed, it will stay failed and will not be used 


again in any future calculations. _ .. 

• The reliability of a sensor can be determined from its Mean Time Between Failure 
(MTBF). This measure is assumed to be constant for the duration of a single engine 


• When a sensor fails it emits random values. Hus is a very conservative assumption, 
and is a more difficult failure mode to detect than a hard failure (i.e., if die algorithm 
is able detect the random failure mode with a high degree of confidence, it will also be 
able to detect hard and drift failures). This is an admission that a failed sensor has 
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some small probability of emitting a value which is within the realm of 
“reasonableness” for the parameter being measured 

The conditional probabilities required to fully define the Belief Network shown in Figure 7 
were derived from the assumptions given above. The following derivations assume that 
all relations are binary (i.e., integrate information from two sensors). 

The probability of a sensor failing on a particular controller cycle is given by 
Equation 1 . P(Sensor Invalid) = CycleTime / MTBF. 

Thus, the probability of a sensor with a MTBF of 30 minutes failing during a 40ms sample 
is 0.0000222, while for a sensor with a MTBF of 20 hours this probability is 0.0000006. 

The probability of a relation holding, given that all of the related sensors are working, is 
determined by the threshold level placed on the relation. Thus, 

Equation 2. P(RelationHolds I SensoriValid, SenscQValid) = K 

where K is a quantile of the normal distribution (e.g. f for a 3 standard deviation relation 
threshold, K = 0.997). 

Since a failed sensor emits random values, there is still some probability, Pn, that a given 
reading may fall within the normal range of values for the sensor, causing the relation to 
continue to hold. (Note that for hard sensor failures P n = 0.) If this normal range is taken 
to be 3 standard deviations, then 

. 2 x 3 x Standard Deviation 

Equation 3. P n = Range of Sensor 

For SSME sensors, Pn has been empirically determined to be have an average value of 
0.22 (although it is slightly different for each sensor). The probability of a binary relation 
holding given that one of its sensors has failed is thus 

Equation 4, P(RelationHolds I SensoriInvalid,Sensor2Valid) = P n 

Equation5. P(RelationHolds I SensoriValid, Sensar2lnvalid) = Pn 

Similarly, the probability of a binary relation holding given that both of its sensors have 
failed is 

Equation 6. P(RelationHolds I Sensorilnvalid, Sensor2lnvalid) = Pn x p n 

The probabilities given above yield the following joint probability distribution for the 
network shown in Figure 7. 

Equation? . P(S1,S2,S3,S4,R1,R2,R3,R4) = 

P(S1) x P(S2) x P(S3) x P(S4) x 
P(R1IS1,S2) x P(R2IS1,S3) x P(R3IS2,S3) x P(R4IS1,S4) 


* * **P(A)” can be read as “the probability of A being true". “P(A3)" can be read as the “the probability of A 

and B being true.” “P(A I B)” can be read as “the probability of A being true given that B is true”. “P(A I 
B,C)” can be read as the “the probability of A being true given that B and C are true”. 
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Given the joint distribution, the goal is to determine the probability of any one sensor 
working given the status of all relations in the network (this is the basis for die real-time, 
one-cycle decision problem). This can be achieved by using Bayes’ rule. For example, 
after measurements for SI, S2, S3, and S4 have been taken, and relations Rl, R2, R3, and 
R4 have been evaluated to determine whether they hold or not, the probability of sensor SI 
working can be determined as follows. 


Equation 9. 


P(S 1 IR 1 ,R2,R3,R4) 


P(S 1 ,R1 ,R2,R3,R4) 
P(R1,R2,R3,R4) 


Baye's Rule 


Where, 


Equation 10. 


P(S 1 ,R1 ,R2,R3,R4) = 

P(S 1 ,S2=Valid,S3=Valid,S4=Valid,Rl ,R2,R3,R4) + 
P(S 1 ,S2= V alid,S 3=Invalid,S4= V alid,R 1 ,R2,R3,R4) + 
P(S 1 ,S2=Invalid,S3=V alid,S4=V alid,Rl ,R2,R3,R4) + 
P(S 1 ,S2=Invalid,S3=Invalid,S4=Valid,Rl,R2,R3,R4) + 
P(S1 ,S2=Valid,S3=Valid,S4=Invalid,Rl,R2,R3,R4) + 
P(S 1 ,S2=Valid,S3=Invalid,S4=Invalid,Rl,R2,R3,R4) + 
P(S 1 ,S2=Invalid,S3=Valid,S4=Invalid,R 1 ,R2,R3,R4) + 
P(S 1 ,S 2=In valid,S3=Invalid,S4=Invalid,R 1 ,R2,R3,R4) 


and 


Equation 11. P(R1,R2,R3,R4) = 

P(Sl=Valid,S2=Valid,S3=Valid,S4=Valid,Rl,R2,R3,R4) + 

P(S 1 =Valid,S2=Valid,S3=Invalid,S4=Valid,Rl ,R2,R3,R4) + 

P(S l=Valid,S2=Invalid,S3=Valid,S4=Valid,Rl,R2,R3,R4) + 

P( S 1 = V alid, S 2=Invalid , S 3=Invalid,S4= V alid,R 1 ,R2 ,R3 ,R4) + 
P(Sl=Invalid,S2=Valid,S3=Valid,S4=ValidJRl,R2,R3,R4) + 

P(S 1 =Invalid, S2= Valid, S 3=Invalid,S4= Valid,Rl ,R2 ,R3,R4) + 
P(Sl=Invalid,S2=Invalid,S3=Valid,S4=Valid,Rl,R2,R3,R4) + 

P(S 1 =Invalid,S2=Invalid,S 3=Invalid,S4=V alid,Rl ,R2,R3,R4) + 

P(S1= Valid, S2=Valid,S3=Valid,S4=Invalid,Rl,R2,R3,R4) + 

P(S l=Valid,S2=Valid,S3=Invalid,S4=Invalid,Rl,R2,R3,R4) + 

P(S l=Valid,S2=Invalid,S3=Valid,S4=Invalid^l,R2,R3,R4) + 

P(S 1 =Valid,S2=Invalid,S3=Invalid,S4=Invalid,Rl ,R2,R3,R4) + 
P(Sl=Invalid,S2=Valid,S3=Valid,S4=Invalid,Rl,R2,R3,R4) + 
P(Sl=Invalid,S2=Valid,S3=Invalid,S4=InvaUd,Rl,R2,R3,R4) + 

P(S 1 =Invalid,S2=Invalid,S3=Valid,S4=Invalid,Rl ^2,R3,R4) + 

P(S 1 =Invalid,S2=Invalid,S3=Invalid,S4=Invalid,Rl ,R2,R3,R4) 

Each term of these latter two equations can be evaluated using the joint probability 
distribution given in Equation 7. 

Given the ability to compute the probability of a sensor being valid or not given the status 
of all relations in the network (as in Equation 9), an optimum one-cycle decision strategy 
can be developed by simply thresholding on this probability. Table 1 shows the validation 
probabilities for sensor SI given that the MTBF of SI, S2, S3, and S4 in Figure 7 is 30 
minutes, the relation residual threshold for Rl, R2, R3, and R4 is 3 standard deviations, 
and Pn is 0.22. From this table it can be seen that the optimum strategy, given these 
assumptions, is to disqualify sensor SI when relations Rl, R2, and R4 do not hold. 
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P(S 1 =V alidIR 1 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidlRl 
P(Sl=ValidIRl 
P(Sl=ValidlRl 


=Holds,R2=Holds,R3=Holds,R4=Holds) 

=Holds,R2=Holds,R3=Holds,R4=NotHold) 

=Holds,R2=Holds,R3=NotHold,R4=Holds) 

=Holds,R2=Holds,R3=NotHold,R4=NotHold) 

=Holds,R2=NotHold,R3=Holds,R4=Holds) 

=Holds,R2=NotHold,R3=Holds,R4=NotHold) 

=Holds,R2=NotHold,R3=NotHold,R4=Holds) 

=Holds,R2=NotHold,R3=NotHold,R4=NotHold) 

=NotHold,R2=Holds,R3=Holds,R4=Holds) 

=NotHold,R2=Holds,R3=Holds,R4=NotHold) 

=NotHold,R2=Holds,R3=NotHold,R4=Holds) 

=NotHold,R2=Holds,R3=NotHold,R4=NotHold) 

=NotHold,R2=NotHold,R3=Holds,R4=Holds) 

=NotHold,R2=NotHold,R3=Holds,R4=NotHold) 

=NotHold,R2=NotHold,R3=NotHold,R4=Holds) 

=NotHold,R2=NotHold,R3=NotHold,R4=NotHold) 


= 1 

= 0.9997204 
= 1 

= 0.9997204 
= 0.9997191 
= 0.7523449 
= 0.9998867 
= 0.8828096 
= 0.9997191 
= 0.7523449 
= 0.9998867 
= 0.8828096 
= 0.7515119 
= 0.002574868 
= 0.9227433 
= 0.01009216 


Table 1. Example Validation Probabilities for Sensor SI 


There are two measures of quality for any validation algorithm; the false alarm and missed 
detection rates (equivalent to Type I and Type II errors in statistics, respectively 19 ). The 
false alarm rate is the probability that the validation system will disqualify a sensor, when it 
is in fact working correctly. The missed detection rate is the probability that the validation 
system will qualify a sensor, when it has in fact failed (this is related to the notion of 
sensitivity). These rates can be computed for the one-cycle decision strategy described 
above. The false alarm rate for sensor S 1 is the sum of 

P(S l=Valid,S2,S3,S4,Rl ,R2,R3,R4) 

in all situations in which the validation system decides to disqualify S 1. For the example 
given above, the false alarm rate is 

2.71412E-8 
+ 3.27073E-10 
2.74683E-8 

Similarly, the missed detection rate for sensor SI is the sum of 

P(Sl=Invalid,S2,S3,S4,Rl,R2,R3,R4) 

in all situations in which the validation system decides to validate SI. For the example 
given above, the missed detection rate is 1.16765E-5. 

These two quality measures were used to evaluate many alternative answers to the 
questions posed above. The results indicated that: 

♦ At least three relations involving a sensor’s value are required to provide enough 
information to disqualify the sensor. 

• The number of relations involving a sensor's value which must be violated in order to 
disqualify the sensor varies with the number of relations. For example, in the network 
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shown in Figure 7 in which sensor S 1 is involved in three relations, all three relations 
must be found not to hold before the common sensor can be disqualified 

• A3 standard deviation residual threshold should be used on all relations to determine if 
they hold or not. 

• A multi-cycle decision strategy must be used in order to get the error rates below 
acceptable levels. The best strategy evaluated was a 3-of-5 strategy, in which a sensor 
must be judged bad (using the one-cycle strategy) on at least three of the last five 
controller cycles before it can be conclusively disqualified. 

Of the results obtained the most significant was that only the relations directly bearing on a 
sensor need to be evaluated in order to validate the sensor. For example, in the network 
shown in Figure 7 only relations Rl, R2, and R4 need to be considered when validating SI 
(see Table 1). 

Given this, and the fact that a voting table can be constructed which specifies the number of 
those relations which must be violated before the sensor can be disqualified an algorithm 
can be designed which only evaluates relations for a particular sensor until it is impossible 
to disqualify it. For example, when validating sensor SI in the network shown in Figure 
7, the relations Rl, R2, and R4 can be examined in sequence, but as soon as one is found 
to hold, the validation process for SI can stop because it is impossible to disqualify it (i.e., 
all three relations must be violated in order to disqualify a sensor with three relations). 
Thus, all relations in the network do not need to be evaluated every cycle. 

The maximum number of relations which can be expected to fail per controller cycle can be 
computed and translated into a hard upper bound on processing time for the validation 
system. Assuming that at most one sensor can fail on a given controller cycle, the 
maximum number of relations which need to be evaluated each cycle is given by the 
following: 

• For each of the valid sensors, the first relation always needs to be evaluated (assuming 
a 3-of-3 disqualification strategy). However, we can compute the probability of a given 
number of additional relations failing and pick the smallest number that gives us the 
reliability we want The probability of more than r relations out of the total R relations 
in the network failing (due to noise and modelling errors) is: 

R 

x P (RelationHolds)R' * x P (RelationNotHold)i 

i=r+l " 

This is a sum of binomial probabilities, which for large R and small 
P(RelationNotHold) can be approximated by a sum of Poisson probabilities, with 

ji=R x P(RelationNotHold). If there are three unique relations for each of 1 15 sensors 
on the SSME, then R=115*(3-l)-2=228 and P(RelationNotHold)=0.003 (for a 3- 
standard-deviation threshold), making p =0.684. A table of Poisson probability 
sums 19 indicates that at most nine additional relations would need to be checked to 
yield a very high degree of confidence. 

• Assuming that one sensor did fail on a given cycle, the number of relations that need to 
be evaluated to confirm the failure is simply the number of immediate relations that the 
sensor has (in the worst case they would all need to be checked). For a sensor with five 
relations, aU five may need to be evaluated in order to disqualify the sensor. 
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Thus, for the 1 14 valid sensors, one relation must always be checked, and we will allow 
an additional nine to be checked in the overall network to guarantee a high level of 
confidence. For the one failed sensor, all three of its relations must be checked. Thus, in 
the worst case, a total of 114 + 9 + 3 = 126 relations need to be evaluated on any given 
cycle. The small number of relations which need to be evaluated each cycle, coupled with 
the fact that only the relations directly involving a sensor need to be evaluated for 
validation, allowed an algorithm to be developed which is entirely scaleable (i.e., will work 
with a large number of sensors and relations). 

These results are based on our assumptions about the accuracy and reliability of the sensors 
on the SSME. Although studies have shown that these results are insensitive to small 
changes in the assumed parameter values (corroborated by De Bruyne^O), large changes 
would require a new analysis (e.g., if the system were to be used to validate sensors on a 
power plant). In particular, order-of-magnitude changes in sensor reliabilities would 
require a re-analysis. Changes in the validation network topology in response to changes 
in SSME hardware configuration will have no effect on these results. 

Software Design. Development and Test 

The algorithm and data structures for the core sensor validation routine which performs the 
one-cycle decision making are outlined in Figure 8 and Figure 9, respectively. Every 
controller cycle, each sensor is checked in sequence. A sensor check consists of evaluating 
all of the relations which directly bear on the sensor until a conclusion about its validity can 
be made. Typically, this will involve evaluating a very small number of relations and then 
stopping when it becomes impossible to disqualify the sensor. When a sensor is 
permanently disqualified, all relations which use its value are deactivated. This ensures that 
the system will not by to perform validation using data from a failed sensor. Thus, the 
algorithm keeps track of which relations are active and which are inactive, and will continue 
to validate a sensor even when fewer relations are available. 

Several additional software modules were developed to augment the core one-cycle 
validation routine. These include: 

• Steady-State Detection — Detects when the engine has reached one of a known set of 
steady-state conditions. 


OneCycleValidate (Sensor) 

Passed <— 0 
Validated False 
NumActiveRelations <- 

CountActiveRelations {Sensor .Relation_List) 

DO for each Relation in Sensor .Relation_List UNTIL Validated 
IF (Relation. Status is Active) THEN 

IF (Relation.Eval_Function {) ) THEN 
Passed f- Passed + 1 

IF (Passed > PassTable [NumActiveRelations] ) THEN 
Validated <— True 

RETURN (Validated) 


Figure 8. One-Cycle Sensor Validation Algorithm 
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Other Related 



Sensor Sensor Relation 

List List 


Figure 9. Primary Data Structures Used in Sensor Validation Software 


• Dynamic Relation Biasing — In order to get the sensitivity required to detect sensor 
failures before hard limits (redlines) were exceeded, the significance of engine-to-engine 
variations in operating conditions had to be understood and addressed. To handle this, 
die system took several data samples as it entered each steady-state condition and biased 
the relations accordingly. This biasing was limited, however, to prevent accommodating 
data from sensors which may have failed during transients (i.e., the bias term was itself 
thresholded). 

• Table Compilation — Since a large portion of the development effort for this system was 
spent on developing and tuning die relations used in the network, a module was 
developed to facilitate the specification of the various data structures used in the system. 
This module takes a text file description of the relations to be used, and compiles all of 
the tables and constants required by the validation system. 

The AREC-hosted SDV system software consisted of about 1,000 lines of C code. It was 
developed on a Sun SPARCstation using recorded sensor data from SSME tests. The 
network shown in Figure 10 was used to validate the High Pressure Fuel Turbine 
Discharge Temperature (HPFT DS T) sensors using six parameters (described in Table 2) 
and eleven binary empirical relations. This was a fully-connected network with the 
exception of relations 93/209, 93/210, 130/209, and 130/210 which proved to be very poor 
predictors and negatively impacted the sensitivity of the system. 

The models used in the AREC-hosted SDV system were empirically derived, binary 
models as indicated by Figure 10. In general, either linear or cubic models were derived. 
Most relationships involving only pressures and/or speeds appeared linear when cross- 
plotted. However, relationships involving temperatures (particularly the High Pressure 
Fuel Turbine Discharge Temperatures) appeared to have a cubic relationship when cross- 
plotted. The following steps were used in the derivation of these models: 

1. Data for several firings were concatenated together into a large training file. For the 
network shown in Figure 10 the tests used were A1618, A1612, A2492, A2497, 
and B 1072, since these represent one firing from each of the different engines for 
which data was available. The datasets were first stripped of all data prior to 
START+7 seconds to remove the startup transient, and all data after the 
SHUTDOWN command. 
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Figure 10. AREC Sensor Validation Network 


PID Number 
93 
130 

209 

210 

231 

232 

Description 
PBP Discharge Temp, Ch A 
MCC Pressure, Ch A1 
LPOP Discharge Pressure, Ch A 
LPOP Discharge Pressure, Ch B 
HPFT Discharge Temp, Ch A 
HPFT Discharge Temp, Ch B 


Control Signals 

280 

Vehicle Command (Engine Start/Stop) 

287 

MCC Pc Control Reference 


Table 2. Eight Sensor Channels Used in the AREC-Hosted Sensor Data 

Validation System 


2. A standard linear regression routine was then used to generate both first and third- 
order polynomial models on the test data for every pair of sensors. 

3 . The third-order models were converted into four first-order models by evaluating 
the first derivative at each power level using average values for the sensors involved 
(referred to as tangent-cubic models). Figure 11 is a graphical depiction of this 
procedure. This was performed both for run-time efficiency (linear models are less 
costly to evaluate than cubic ones) and because it was felt that the tangent-cubic 
models would perform better under anomalous engine conditions than linear models 
trained on power-level-specific data. 

4. A program was run for all relations which computed the average of the residuals for 
all models at each power level. 

5 . A subset of the relations derived in steps 2 and 3 was selected for use (in particular, 
only a first-order OR a tangent-cubic model was used for any given pair of 
sensors). 

6. Initial thresholds were defined for the selected models based on the results of step 4 
(initially set at three standard deviations). 

7. The assembled SDV system was tested against the full-sample data from the 
training datasets to ensure that no false alarms were issued. 
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Figure 11. Tangent-Cubic Empirical Model 


8 . A variant of the SD V system was run to determine the sensitivity of the system in 
detecting failures in each of the sensors. This was done by setting all sensors to 
their mean values and then varying one sensor's value incrementally until it was 
failed (the overall process was repeated for all power levels, for all sensors, and for 
high and low variations). The mean values were taken from the Phase II SSME 
Data Base maintained at NASA MSFC (dated 10/13/89). The primary purpose of 
this test was to ensure that slow drifts in redline sensors would be detected by the 
sensor validation system before the values reacted redline. 

9. The model residual thresholds were tuned to ensure maximum sensitivity while 
ensuring that no false alarms were issued. This involved many iterations through 
steps 7, 8, and 9. The final thresholds incorporated into the run-time sensor 
validation system are constant, and do not change between power levels. 

10. A program was run to compute the relation biases (model offsets) used on a 
number of different test datasets. This information was used to set the bias limits. 
Since there were not enough datasets to obtain a statistically significant sample of 
biases for each sensor, the limits were empirically set to 150% of the largest bias 
seen. 

The sensor validation system was then tested on three additional validation datasets — 
A2495, B1069, and B1071 — without any false alarms being issued (these were the only 
additional datasets available at the time; for increased reliability the SDV system should be 
validated on a much wider range of datasets). In addition, sensitivity analyses were 
successfully ran on all red-line sensors to ensure that the validation system would detect 
slow drift failures prior to redline exceedance. These tests were performed on the 
development workstation in a non-real-time environment 


Simulation Laboratory Tests 

The sensor validation software was then integrated into the Advanced Rocket Engine 
Controller and set up in Aerojet's Real-Time Simulation Laboratory. This facility is based 
on an AD- 100 multiprocessor computer, which is capable of either simulating engine 
firings or replaying data from engine firings in real-time. The AD-100 was programmed to 
replay recorded data from 10 SSME firings in order to test the AREC and the real-time 
characteristics of the sensor validation system. The system correctly monitored nine normal 
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SSME tests in real time without any false alarms being generated. The system correctly 
detected a hard failure in HPFT DS T on a tenth SSME test dataset 21 Table 3 summarizes 
these results. 


Test — 

Duration 

Results 

Altil$ “ 

529 

No false alarms. 

A2497 

550 

No false alarms. 

A2493 

550 

No false alarms. 

B1046 

530 

No false alarms. 

B1064 

520 

No false alarms. 

B1067 

700 

No false alarms. 

B1073 

80 

No false alarms. 

B1075 

300 

No false alarms. 

B1077 

513 

No false alarms. 

A1637 


Failure occurred during power level 
transient. SDV system detected failure 1.48 
seconds later, following its post-transient 
delay and training interval (performed 
correctly). 


Table 3. Simulation Laboratory False Alarm and Hard Failure Detection 

Test Results 


In order to evaluate the sensitivity of the system to “soft” sensor failures in a real-time 
environment, a series of tests were run in which a slow drift in HPFT DS T (high or low) 
was simulated by the AD- 100 computer while all other sensors were held at their nominal 
values (engine test data was not used for these tests). The point at which the system 
disqualified die sensor was then recorded. These tests, summarized in Table 4, indicated 
that the system had adequate sensitivity to soft failures. 

Real-time Validation on TI B 

Following tests in APD's Real-Time Simulation Laboratory, the AREC-based sensor 
validation system was installed in the Technology Test Bed blockhouse at MFSC to receive 
and analyze real-time data from TTB hot-fire tests. The same validation network and sensor 
validation software configuration used in the Simulation Laboratory tests were used at 
TTB. 

Table 5 s ummari zes the results of the TTB tests. The sensor validation system correctly 
tracked engine start, stop, and power level transitions, performed bias training, and 
monitored nominal data without issuing any false alarms. However, none of the monitored 
sensors experienced failures during the test series, so the sensitivity of the system in the 
TIB environment could not be established. 


n.3. Empir ical and Characteristic Modeling . . 

In FY92 Aerojet undertook the task (under the Life Prediction contract) of determining the 
viability of using analytical redundancy to validate the majority of the sensors used on 
SSME for control and health monitoring. The basic approach was to identify and 
investigate sets of engine parameters whose measurements are statistically correlated for a 
no minal engine firing, or whose measurements are known to be related via first-principle 
(characteristic) equations. 
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"FID" 

Drift - " 

Direction 

Power 
Level % 

Value at Which 
Sensor Was 
Disqualified 

Criteria for Pass 
(Redline) 

2ii 

High 

65 

1550 

<1850 


n 

100 

1718 

it 


it 

104 

1761 

•i 


w 

109 

1842 

n 


Low 

65 

1406 

None 


ft 

100 

1229 

ft 


ft 

104 

1361 

»t 


if 

109 

1384 

ft 

23l 

High 

65 

1611 



it 

100 

1716 

it 


it 

104 

1798 

tt 


it 

109 

1900 

»t 


Low 

65 

1400 

None 


t« 

100 

1616 

it 


tl 

104 

1641 

H 


H 

109 

1710 

ft 


Table 4. Simulation Laboratory Tests of “Soft” Failures via Induced Drifts 


test 

Date 

Duration” 

(seconds) 

Notes 

W53T" 

4/15/92 ' 

85 

Nominal firing. No false alarms, no missed 
detections. 

TTB -032 

4/28/92 

205 

Nominal firing. No false alarms, no missed 
detections. 

TTB -033 

5/14/92 

18 

Ambient powerhead temperature redline cutoff. No 
false alarms, no missed detections. 

TTB -034 

5/28/92 

210 

Nominal firing. No false alarms, no missed 
detections. 

TTB-035 

6/11/92 

200 

Nominal firing. No false alarms, no missed 
detections. 


Table 5. TTB Test Results 


Sensor Selection 

Table 6 lists the engine parameters and the appropriate sensors investigated in this task. 
Some of these parameters were selected as being critical to safely operating the engine, 
including control and redline parameters and those identified for use in advanced safety 
algorithms. Less critical sensors that might provide additional analytical redundancy 
coverage were also included. Sensor data is captured by two different systems during an 
SSME firing: the engine controller relays data from sensors with PH) numbers of 300 or 
less via a Command and Data Simulation (CADS) computer; while sensors with PID 
numbers over 300 are caputured by the facility data recording system. 
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aramete r PID PIDsUsed 


High Pressure Fuel Pump (HPFP) Shaft Speed 260,261,764 260,764 

High Pressure Fuel Turbine (HPFT) Discharge 231,232 23 1,232 

Temperature 

HPFP Discharge Pressure 52,459 52 

Main Combustion Chamber (MCC) Pressure 129,130,161,16 129 

2,63 

Fuel Prebumer (FPB) Chamber Pressure 58,410 58 

HPFP Coolant Liner Pressure 53,54 53 

Oxidizer Prebumer (OPB) Chamber Pressure 480 480 

FPB Oxidizer Valve Position 42,143,175 42,175 

HPFP Inlet Pressure 203,204 203 

Oxidizer Flow (Facility) 1212,1213 1212 

Fuel How (Facility and Engine) 133,253,30 1 , 1 33,722, 

251,722,1205, 1205 

1206 

MCC Coolant Discharge Pressure 17 17 

Low Pressure Fuel Turbine Inlet Pressure 436 436 

Low Pressure Fuel Pump (LPFP) Speed 32,754 32 

Low Pressure Oxidizer Pump (LPOP) Speed 30,734 30 

High Pressure Oxidizer Turbine (HPOT) Discharge 233,234 233,234 

Temperature 

MCC Hot Gas Injection Pressure 24,37 1 24,37 1 

MCC Oxidizer Injection Temperature 21 ,595 21 

OPB Oxidizer Valve Actuator Position 40,141,176 40,176 

MCC Coolant Discharge Temperature 18 18 

LPOP Discharge Pressure 209,210 209 

Prebumer Boost Pump (PBP) Discharge Temperature 93,94 93 

MCC Liner Cavity Pressure 1951,1956,1957 1951 

HPOP Discharge Pressure 90,334 90,334 

PBP Discharge Pressure 59,341 59 

HPFP Discharge Temp 659 659 

HPOP Inter. Seal Purge Pressure 21 1,212 211 

HPOT Secondary Seal Cavity Pressure 91,92 91 

HPFP Inlet Temp 225,226 225 

HPOP Balance Cavity Pressure 327,328 327,328 

HPFP Balance Cavity Pressure 457 457 

HPFP Coolant Liner Temp 650 650 

Engine Fuel Inlet Pressure 819,821,827 819 

Engine Oxidizer Inlet Pressure 858,859,860 858 

HPOP Primary Seal Drain Pressure 951,952,953 951 

HPOT Primary Seal Drain Pressure 990 990 

Engine Fuel Inlet Temp. 1021,1017,1018 1021,1017 

Engine Oxidizer Inlet Temp 1058,1054,1056 1058,1054 

HPOT Secondary Seal Drain Temp 1 188 1188 

HPOT Primary Seal Drain Temp 1190 1190 

Fuel Repressure Interface Pressure 835 835 


Table 6. Sensors Used in FY92 Modeling Task 
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The primary objective of this task was to consider the relationships between various engine 
parameters, thus redundant sensors were typically not evaluated (i.e., only one PID per 
parameter was used in the analyses). Several redundant measurements were included after 
an initial analytical and statistical survey identified those which showed significant 
differences. 


Data Preparation 

The data sets used consisted of nine nominal test firings for training and two additional test 
firings for verification. As shown in Table 7, these test cases included various engines 
including multiple tests with the same engine, thus providing useful information on test to 
test variations. 


Test Firing 

Engine 

Duration 

Use 

£ 233 ) — 

2206 

300.00 sec 

Training 

A2536 

2206 

300.00 sec 

Training 

A2539 

0216 

530.00 sec 

Training 

A2547 

2011 

420.00 sec 

Training 

A2548 

2206 

300.00 sec 

Training 

B1060 

0213 

530.00 sec 

Training 

B1069 

0213 

700.00 sec 

Training 

B1077 

0213 

513.00 sec 

Training 

B1089 

0213 

530.00 sec 

Training 

B1063 

0213 

513.00 sec 

Verification 

A2537 

2035 

300.00 sec 

Verification 


Table 7. Test Firing Datasets Used in FY92 Modeling Task 


The sensor measurements were initially prepared by removing the start transients (first 
seven seconds after ignition) and the shutdown transients. The data was then smoothed 
and reduced from approximately one-half million data points per dataset to 50,000 data 
points per dataset to make the modeling procedures tractable. Only routines which 
computed model coefficients were run on this reduced data; all other routines, including all 
validation tests, used the original full sample data. 

Empirical Model Ranking . . 

Initially, first and third degree binary curve fits were computed between all pans of selected 
PIDs. The curve fits were ranked for each test according to minim al residual variance and 
the rankings were averaged across the nine training test firings (e.g., if a model had the 
third lowest residual variation in half of the tests and the fourth lowest residual variation in 
the other half, its final ranking would be 3.5). As an example. Table 8 lists the top 20 
ranked linear and cubic fit parameters for the High Pressure Riel Pump Speed, Channel A 
sensor (PID 260). The “rank” column in this table is the averaged rank value described 
above. 
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260 


RPM 


HPFP SPEED A 


Linear fit 

ranking. 





rank 

n 

name 




0.00000 

9 

260 

RPM 

HPFP SPEED A 


1.00000 

9 

764 

RM 

HPFP SPD NFD 

48KRPM 

4.44444 

9 

[6591 

T2 

HPFP DS T CH A 

30/560 

4.88889 

9 

. ; 129 

PSIA 

MCC PC A2 


5.88889 

9 

fin 

PS I A 

MCC CLNT DS PR 


7.22222 

9 

436 

GP 

LPFT IN PR 1 

10K PSIS 

7.33333 

9 

- ri33j 

GPM 

FUEL FLOW A1 


7.44444 

9 

722 

GM 

ENG FL FLOW NFD 

29KGPM 

7.44444 

9 

30 

RPM 

LPOP SPEED 


8.00000 

9 

. 53 

PSIA 

HPFP CLNT LNR A 


10.0000 

9 

52 

PSIA 

HPFP- DS PR A 


10.8889 

9 

371 

GP 

MCC H. G. INJ PR0/5000PS 

13.8889 

9 

1205 

GM 

FAC FL FLOW 1 

22KGPM 

14.0000 

9 

90 

PSIA 

HPOP DS PR A 


15.7778 

9 

457 

GP 

HPFP BAL CAV PR 

10K PSIS 

16.6667 

9 

328 

GP 

HPOP BALCAV 2A P5K PSI 

16.7778 

9 

. 334 

AP 

HPOP DS PR NFD 

7K PSIA 

16.7778 

9 

1212 

GM 

FAC OX FLOW 1 

8500GPM 

18.3333 

9 

835 

GP 

FL PRESS INT PR 

5K PSIG 

19.6667 

9 

58 

PSIA 

FPB PC A 


19.8889 

9 

. .. 327 

GP 

HPOP BALCAV 1A P5K PSI 

Cubic fit ranking. 





rank 

n 

name 




0.00000 

9 

260 

RPM 

HPFP SPEED A 


1.11111 

9 

764 

RM 

HPFP SPD NFD 

48KRPM 

3.44444 

9 

V 129 

PSIA 

MCC PC A2 . 


4.33333 

9 

722 

GM 

ENG FL FLOW NFD 

29KGPM 

5.77778 

9 

65.9 

T2 

HPFP DS T CH A 

30/560 

6.00000 

9 

133 

GPM 

FUEL FLOW A1 


6.66667 

9 

53 

PSIA 

HPFP CLNT LNR A 


8.33333 

9 

US 

PSIA 

MCC CLNT DS PR 


9.66667 

9 

*~T36 

GP 

LPFT IN PR 1 

10K PSIS 

9.77778 

9 

371 

GP 

MCC H. G. INJ PR0/5000PS 

10.1111 

9 

52 

PSIA 

HPFP DS PR A 


13.0000 

9 

457 

GP 

HPFP BAL CAV PR 

10K PSIS 

13.7778 

9 

30 

RPM 

LPOP SPEED 


15.1111 

9 

90 

PSIA 

HPOP DS PR A 


15.6667 

9 

1205 

GM 

FAC FL FLOW 1 

22KGPM 

16.8889 

9 

32 

RPM 

LPFP SPEED 


17.7778 

9 

328 

GP 

HPOP BALCAV 2A 

P5K PSI 

17.8889 

9 

1212 

GM 

FAC OX FLOW 1 

8500GPM 

17.8889 

9 

334 

AP 

HPOP DS PR NFD 

7K PSIA 

19.6667 

9 

58 

PSIA 

FPB PC A 


20.1111 

9 

835 

GP 

FL PRESS INT PR 

5K PSIG 


Table 8. Ranked Linear and Cubic Fit Parameters for PID 260 
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These rankings were analyzed and the top three candidate models were selected for each 
parameter (e.g., the circled PIDs in Table 8). Other than removing redundancies from 
consideration, parameters were selected on die basis of their ranking and knowledge of 
nominal SSME operation. For example, in Table 8, PID 129 was not selected because 
most parameters nave a very high correlation with Main Chamber Pressure (almost all 
measurements in the engine scale up and down with power level) and PID 436 was not 
selected because the cubic model did not rank well, and because it is “causally remote” 
from the PID 260 measurement Attachment 1 presents the selected parameters and a brief 
rationale for each, the average “rank” value described above, the order of the model 
selected for use (“1” for linear and “3” for cubic) and an evaluation of the model fit with 
and without bias training. 


Empirical Model Evaluation 

The linear and cubic fit coefficients and residual characteristics for the three selected 
empirical relations for each sensor were then computed. Nine sets of coefficients were 
computed for each relation by performing linear regression on each of the nine training 
datasets individually. A composite, or “accumulated” model was then formed for each 
relation by averaging the coefficients obtained for each training dataset This accumulated 
model was then evaluated against each of the training datasets, and the mean and standard 
deviation of the residual computed. Finally, the average of these means and standard 
deviations for the accumulated model was computed as a measure of the overall quality of 
the model. 

Tables 9 and 10 show these values for the three selected models for HPFP SPEED CH A 
(PID 260) in linear and cubic form, respectively. In each of these tables, the “Mean” and 
“Sigma” values are the mean and standard deviation of the model residual, and “CO”, “Cl”, 
etc., are the model coefficients (with “CO” being the zero-order coefficient). Note that the 
dynamic range of PID 260 is 1,350 to 45,000 RPM, so that the seemingly large residual 
standard deviations are actually only about 1/2% of the sensor's range. 

Figures 12-16 are examples of scatter plots* (for the model relating PID 260 to PID 659) 
which were generated to show how well the empirical relationships fit the data. Figures 12 
and 13 are plots for test A2530 which shows how the linear and cubic models fit a single 
training dataset (with the models constructed on the same dataset). Figures 14 and 15 are 
scatter plots for averaged relations (i.e., with coefficients averaged over all training tests), 
evaluated against all test firing data to show the effects of test to test variations. Figure 16 
is a scatter plot for the averaged relations evaluated against a single validation test firing 
dataset (B 1063). 


Attachment 1 includes some observations from this data. Parameters were identified as 
good fits if their residual standard deviation was less than 1% of the maximum parameter 
value (maximum dynamic range of the sensor). Medium fit was associated with a residual 
standard deviation of 1% - 2.5% of the maximum parameter value, and a poor fit was 
considered when the residual deviations were in excess of 2.5%. Those parameters that 
were basically not correlated were identified as unusable. 

Attachment 2 presents the averaged coefficients for all selected linear and cubic models. 


* A single sample of data following the engine shutdown signal was erroneously included 
in each of the empirical training datasets; these show up on the plots as single outlier data 
points. It was believed that one data point out of 1200 would not affect the results. 
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RPM 


HPFP SPEED A 


Linear Curve Fit 


y-pid = 260 

x-pid = . 659 T2 

Residual 


Test 

Mean 

Sigma 

a2530 

-3.68E-04 

2.18E+02 

a2536 

9.25E-04 

1.51E+02 

a2539 

-1.68E-04 

1.91E+02 

a2547 

3.17E-04 

2.78E+02 

a2548 

1.23E-03 

1.88E+02 

bl060 

4.24E-04 

3.02E+02 

bl069 

3.26E-03 

2.75E+02 

bl077 

-4.25E-04 

3.21E+02 

bl089 

-2.04E-03 

1.75E+02 

Accum 

-1.98E+01 

6.19E+02 


HPFP DS T CHA 

CO Cl 

-6. 0585E+03 4.3131E+02 

-7.0018E+03 4 . 3608E+02 

-6. 6352E+03 4.4143E+02 

-7 . 0957E+03 4.4303E+02 

-6.9675E+03 4.3826E+02 

-5.7085E+03 4.2960E+02 

-5.6677E+03 4.2677E+02 

-5.4051E+03 4 . 2730E+02 

-5. 3045E+03 4.0703E+02 

-6.2050E+03 4 . 3120E+02 


X-pid = 17 PSIA 

Residual 


Test 

Mean 

Sigma 

a2530 

1.93E-03 

2.61E+02 

a2536 

1.63E-03 

1.97E+02 

a2539 

1.84E-03 

2.62E+02 

a2547 

1.06E-03 

3.33E+02 

a2548 

-5.66E-04 

3 . 07E+02 

bl060 

1.23E-03 

3 . 06E+02 

bl069 

1.10E-03 

2 . 59E+02 

bl077 

-9.70E-04 

3.18E+02 

bl089 

-2.03E-03 

2.62E+02 

Accum 

-2.07E+01 

4.82E+02 


x-pid = >' 133 GPM 

Residual 


MCC CLNT DS PR 

CO Cl 

1.3163E+04 4 . 9021E+00 

1.3155E+04 5. 0277E+00 

1. 3296E+04 4 . 9604E+00 

1. 3113E+04 4.8169E+00 

1. 3155E+04 4 * 9314E+00 

1. 2835E+04 4 . 9736E+00 

1. 2867E+04 4.9860E+00 

1. 3640E+04 4 . 6331E+00 

1. 2837E+04 4 . 8696E+00 

1 . 3118E+04 4 . 9001E+00 

FUEL FLOW A1 


Test 

Mean 

Sigma 

CO 

Cl 

a2530 

-1.17E-03 

2 . 65E+02 

1. 2923E+04 

1. 3551E+00 

a2536 

8.78E-04 

2.22E+02 

1. 3077E+04 

1. 3663E+00 

a2539 

1.10E-03 

2.40E+02 

1. 2936E+04 

1. 3763E+00 

a2547 

1.37E-03 

3.36E+02 

1 . 2968E+04 

1.3653E+00 

a2548 

-5.27E-04 

2.93E+02 

1. 2785E+04 

1. 3714E+00 

bl060 

3.04E-03 

3.10E+02 

1. 3289E+04 

1. 3542E+00 

bl069 

5.16E-04 

2.59E+02 

1.3154E+04 

1. 3614E+00 

bl077 

4.01E-04 

3.20E+02 

1. 3383E+04 

1.3426E+00 

bl089 

-2.09E-04 

2.81E+02 

1. 3223E+04 

1 . 3651E+00 

Accum 

-4.93E+00 

3.13E+02 

1. 3082E+04 

1.3620E+00 


Table 9. Linear Empirical Fit Coefficients for PID 260 
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Third Order Curve Fit 


y-pid = 

: 260 

RPM HPFP SPEED A 

x-pid = 

659 ' 

Residual 

T2 HPFP DS T CHA 

Test 

Mean Sigma 


a2530 

-1.47E-02 1 

. 53E+02 


a2536 

-1.64E-03 6 

. 19E+01 . 


a2539 

5.66E-03 1 

. 48E+02 


a2547 

1.56E-02 1 

. 43E+02 


a2548 

-3.38E-03 7 

. OOE+Ol 


bl060 

1.23E-02 2 

. 93E+02 


bl069 

-3.16E-03 2 

, 46E+02 


bl077 

-4.89E-03 3 

. 08E+02 


bl089 

-6.63E-03 1 

. 19E+02 


Accum 

1.35E+01 5 

. 31E+02 


Test 

CO 

Cl 

C2 C3 

a2530 

5. 2353E+04 

-1. 8947E+03 

3 . 0175E+01 -1.2796E-01 

a2536 

5. 1549E+04 

-1.8052E+03 

2.8182E+01 -1.1648E-01 

a2539 

3 . 8672E+04 

-1. 3295E+03 

2.2643E+01 -9. 4948E-02 

a2547 

6. 2633E+04 

-2 . 3689E+03 

3 . 6800E+01 -1. 5701E-01 

a2548 

4.8362E+04 

-1.6841E+03 

2 . 6777E+01 — 1 . 1117E-01 

bl060 

6.4350E+04 

-2 . 3934E+03 

3 . 6885E+01 -1. 5718E-01 

bl069 

7. 7948E+04 

-2 . 9436E+03 

4 . 4085E+01 -1.8807E-01 

bl077 

5. 6826E+04 

-2 . 0473E+03 

3 . 1907E+01 -1. 3412E-01 

bl089 

5. 0955E+04 

-1 . 7056E+03 

2.5870E+01 -1. 0371E-01 

Accum 

5. 5961E+04 

-2.0192E+03 

3.1481E+01 -1. 3229E-01 

x-pid = 

» , 17 

Residual 

PSIA MCC 

CLNT DS PR 


Test 

a2530 

a2536 

a2539 

a2547 

a2548 

bl060 

bl069 

bl077 

bl089 

Accum 

Test 

a2530 

a2536 

a2539 

a2547 

a2548 

bl060 

bl069 

bl077 

bl089 

Accum 


Mean 

Sigma 

-5.24E-03 

2.29E+02 

-1.30E-03 

1.67E+02 

5.31E-03 

1.68E+02 

3.81E-03 

1.40E+02 

-2.28E-03 

2.50E+02 

-1.07E-02 

2.93E+02 

5.54E-03 

2.38E+02 

5.09E-03 

3.06E+02 

-7.51E-03 

1. 24E+02 

-2.52E+01 

5.13E+02 

CO 

Cl 


-8. 1156E+03 
-2. 2078E+03 
-2. 5454E+04 
-4 . 4082E+04 
-1.7856E+04 
-4. 5246E+04 
-3.9595E+04 
-1. 2878E+04 
-6.2965E+04 
-2. 8711E+04 


2 . 1424E+01 
1. 7063E+01 
3 . 5670E+01 
4.9817E+01 
3.0336E+01 
5. 1827E+01 
4 . 7428E+01 
2 . 3676E+01 
6 . 4931E+01 
3 .8019E+01 


C2 

-4.1676E-03 
-3.0331E-03 
-7.9006E-03 
-1. 1386E-02 
-6.7359E-03 
-1. 2376E-02 
-1.1247E-02 
-4.4670E-03 
-1.5588E-02 
-8.5447E-03 


C3 

3.4339E-07 
2.4769E-07 
6.6387E-07 
9. 3559E-07 
5.8198E-07 
1. 0740E-06 
9.7927E-07 
3 . 4380E-07 
1.3289E-06 
7. 2206E-07 


Table 10. Cubic Empirical Fit Coefficients for PID 260 
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. 260 RPM HPFP SPEED A 


Third Order Curve Fit 
y-pid - 45 260 RPM 


x-pid = 


23 133 
Residual 


GPM 


HPFP SPEED A 
FUEL FLOW A1 


Test 

Mean 

Sigma 

a2530 

3.29E-03 

2.04E+02 

a2536 

1.05E-02 

1.77E+02 

a2539 

-4.63E-03 

1.20E+02 

a2547 

9.46E-03 

1.42E+02 

a2548 

5.91E-03 

2.01E+02 

bl060 

-1.51E-02 

2 . 91E+02 

bl069 

-1.11E-02 

2.29E+02 

bl077 

-7.02E-03 

3.08E+02 

bl089 

1.88E-03 

1.32E+02 

Accum 

-1.79E+01 

2.82E+02 

Test 

CO 

Cl 


a2530 -2.8979E+04 
a2536 -1.8418E+04 
a2539 -3.4949E+04 
a2547 -5.2971E+04 
a2548 -3.2900E+04 
bl060 -6.2824E+04 
bl069 -5 . 6651E+04 
bl077 -3 . 2726E+04 
bl089 -7.3562E+04 
Accun -4.3776E+04 


1. 0810E+01 
8 . 4511E+00 
1.2037E+01 
1. 6344E+01 
1. 1827E+01 
1 . 8687E+01 
1.7296E+01 
1. 1506E+01 
2 . 1184E+01 
1.4238E+01 


C2 

-6.9746E-04 

-5.1906E-04 

-7.7387E-04 

-1.0989E-03 

-7.7853E-04 

-1.2922E-03 

-1.1915E-03 

-7.3309E-04 

-1.4824E-03 

-9.5189E-04 


C3 

1. 6863E-08 
1. 2443E-08 
1. 8400E-08 
2.6247E-08 
1. 8946E-08 
3 . 1627E-08 
2 . 9255E-08 
1.7345E-08 
3.6404E-08 
2 . 3059E-08 


Table 10. Cubic Empirical Fit Coefficients for PID 260, cont'd 



Figure 12. Linear Model Relating Pros 260 and 659 for Test A2530 
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260 RPM HPFP SPEED A 



Figure 13. Cubic Model Relating PIDs 260 and 659 for Test A2530 
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, 260 RPM HPFP SPEEO A 


Ar.cumulated Training Tests 


3.5x10 


3.0x10 


2.5x10 


2.0x10 


1.5x10 



60 70 80 90 100 

659 T2 HPFP DS T CH A 30/560 


Figure 15. Averaged Cubic Model Relating PIDs 260 and 659 
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16. Validation of Models Relating PIDs 260 and 659 on Test B1063 




Characteristic Equation Selection. ^ 

The characteristic relations were identified through consideration of available sensors and 
knowledge of engine first principles. Of those considered, die sparsity of sensors on die 
SSME allowed only three types to be applied: pump flow to impeller speed, pressure rise 
across a pump to the square of its speed; and line resistance (pressure drop to the flow 
squared). Table 1 1 summarizes die characteristic equations considered. The components 
referred to are: High Pressure Oxidizer Pump (HPOP); High Pressure Fuel Pump (HPFP); 
Low Pressure Oxidizer Pump (LPOP); Low Pressure Fuel Pump (LPFP); Low Pressure 
Fuel Turbine (LPFT); and Main Combustion Chamber (MCQ. In addition, “DS P” and 
“IN P” refer to discharge pressure and inlet pressure, respectively. The last three models 
for line resistances are approximations because not all instrumentation required was 
available for true first principle relationships. 


■MCTng.a i 

Equation 

Form 

1,2 

Fuel Flow , 

LPFP Speed _constant 

Pump 

Affinity 

3,4 

LOX Flow . . 

LPOP Speed " constant 


5,6 

Fuel Flow , ^ 

HPFP Speed - constant 

Pump 

Affinity 

mm 

LPOP DS P - Eng LOX IN P 

g -■* = constant 

LPOP Speed 2 



HPFP IN P - Eng Fuel IN P 

r-^- „ ys = constant 

LPFP Speed 2 

Pump 

Affinity 


HPFP DS P - HPFP IN P , 

HPFP Soced^ COnS “ t 

Pump 

Affinity 

16,17,18 

LOX Flow 2 

Line 

Resistance 

19,20,21 

MCC Coolant DS P - LPFT IN P . . 

— — — 7 * = constant 

LPFP Speed 2 

Line 

Resistance 

nn 

HPOP DS P - LPOP DS P 

— — -5 = constant 

LPOP Speed 2 

Line 

Resistance 


Table 11. Characteristic Equations Evaluated 


Characteristic Equation Fit . 

Attachment 3 provides details of the characteristic equations evaluated and the coefficients 
derived from the training datasets. The models coefficients shown have been averaged over 
all training datasets in the same manner as the “accumulated” empirical models. As an 
example. Table 12 shows the derived coefficients for the characteristic equation relating 
LOX Flow and LPOP Speed. In each of these tables, the “Mean” and “Sigma” values are 
the mean and standard deviation of the model residual, and “CO”, “Cl”, etc., are the model 
coefficients. The large residual means and relatively small residual standard deviations for 
these models indicate that constant offsets (a zero-order term in the equation) should always 
be used, even though the first principle relations do not specify their use. Offsets for the 
accumulated (averaged) characteristic models should simply be the average of the residual 
means computed. 

Figures 17-19 are examples of the scatter plots generated during the study to show the 
quality of characteristic relations when used as predictive models. Figure 17 is a plot for 
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Characteristic Relation 

Fac LOX Flow/ Lpop Spd = constant 

PID 1212 : Fac LOX Flow 
PID 30 : Lpop Spd 


Characteristic Curve Fit 


PID 1212 = cl 

* PID 

30 


Residual 



Test Mean 

Sigma 

Cl 

Cl S.Err 

a2530 -3.16E+03 

6.47E+01 

1. 7572E+00 

4.29E-03 

a2536 -2.97E+03 

4.35E+01 

1. 7047E+00 

2.10E-03 

a2539 -3.08E+03 

3.83E+01 

1 . 7262E+00 

3.16E-03 

a2547 -3.12E+03 

4.52E+01 

1.7812E+00 

4.95E-03 

a2548 -2.89E+03 

4.97E+01 

1. 6816E+00 

3.59E-03 

bl060 -3.18E+03 

4.30E+01 

1. 7374E+00 

3.72E-03 

bl069 -3.21E+03 

5.06E+01 

1. 7414E+00 

3.74E-03 

bl077 -3.30E+03 

4.78E+01 

1. 7637E+00 

2.67E-03 

bl089 -3.38E+03 

3.88E+01 

1.8136E+00 

4.79E-03 

Accum -3.14E+03 

1.04E+02 

1. 7452E+00 

1.41E-03 


Characteristic Curve Fit 



PID 

30 = cl 

* PID 1212 



Residual 



Test 

Mean 

Sigma 

Cl 

Cl S.Err 

a2530 

1.82E+03 

3.67E+01 

5.6549E-01 

1.38E-03 

a2536 

1.75E+03 

2.55E+01 

5.8541E-01 

7.21E-04 

a2539 

1.80E+03 

2.21E+01 

5. 7762E-01 

1.06E-03 

a2547 

1.76E+03 

2.53E+01 

5. 5966E-01 

1.56E-03 

a2548 

1.73E+03 

2.95E+01 

5. 9330E-01 

1.27E-03 

bl060 

1.89E+03 

2.45E+01 

5. 6574E-01 

1.21E-03 

bl069 

1.88E+03 

2.89E+01 

5. 6776E-01 

1.22E-03 

bl077 

1.90E+03 

2.70E+01 

5. 6168E-01 

8.51E-04 

bl089 

1.88E+03 

2.14E+01 

5.4902E-01 

1.45E-03 

Accum 

1. 82E+03 

5.99E+01 

5.6952E-01 

1.68E-04 


Table 12. Characteristic Equation Coefficients for LPOP Equation #3 


test A2530 which shows how the characteristic equation fits a single training dataset (with 
the model constructed on the same dataset). Figure 18 is a scatter plot with model 
coefficients averaged over all training tests and evaluated against all test firing data. 
Figures 19 and 20 are scatter plots for the averaged model evaluated against individual 
validation test firings. Table 13 is an evaluation of all characteristic equations considered. 

Rssultsj>£ Empirical Modeling 

Relations were successfully developed for 33 of the 53 parameters analyzed using linear 
and cubic binary models. Of the remaining 20 parameters, two were found to be 
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Predicted 1212 GM FAC OX FLOW 1 8500GPM 

Figure 18. Averaged Model for LPOP Equation #3 




Actual 1212 GM FAC OX FLOW 1 8500GP 






Eqn No 

FID 

Comments 

1 . 

1205 

Poor fit. Bias training will help. 

2. 

32 

Medium fit. Bias training may help. 

3. 

1212 

Medium fit 

4. 

30 

Medium fit 

5. 

1205 

Good fit 

6. 

260 

Medium fit 

7. 

209 

Good to medium fit 

8. 

858 

Medium to poor fit Bias training may 
help. 

9. 

30 

Poor fit. Bias training may help. 

10. 

203 

Poor fit Bias training may help. 

11. 

819 

Very poor fit 

12. 

32 

Poor fit Bias training may help. 

13. 

52 

Medium to good fit Bias training may 
help. 

14. 

203 

Poor fit Bias training may help. 

15. 

260 

Medium fit Bias training may help. 

16. 

90 

Good fit 

17. 

129 

Good fit 

18 

1212 

Good fit 

19 

17 

Good fit. Bias training will help. PID32 
relation not helpfuL 

20. 

436 

Good fit. Bias training will help. PID32 
relation not helpfuL 

21 

32 

Medium fit 

22 

90 

Medium fit Bias training will help. 

23 

209 

Poor fit 

30 

30 

Medium fit. Bias training will help. 


Table 13. Characteristic Equation Observations 


anomalous (PID 24 and PID 328*) and six parameters appeared amenable to multi- 
parameter regression modeling (i.e., PIDs 203, 233, 234, 209, 819, and 858 appear to be 
a function of more than any one other parameter). The remaining 12 PIDs (18, 1951, 21 1, 
225, 650, 951, 1021, 1017, 1058, 1054, 1188, and 1190) essentially did not correlate well 
to any other measurements. A good example of this set is PID 1951 (MCC LINER CAV 
P). According to SSME data analysts, this measures the pressure in a cavity between the 
inside of the MCC and the outer wall of the combustion chamber. The normal behavior for 
this sensor is to drop during start (as the MCC heats up, the cavity pulls a vacuum and the 
pressure drops) and then level off for the rest of the test This parameter's value is thus 
primarily a function of time from START. These measurements which do not correlate well 
to other parameters can be dropped from the list of sensors evaluated by the SDV system, 
unless they are needed for control, redline, or health monitoring purposes, in which case a 
more focused modeling effort will need to be undertaken. 


* At the completion of the analyses it was discovered that anomalous data from these two 
PIDs had been included in the training datasets. 
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In summary, a large percentage of the sensors on SSME can be successfully modeled using 
linear and cubic polynomial regression techniques. The remaining sensors could be 
modeled using multi-parameter models, or other forms of models such as time-based 
models of nominal behavior, or more advanced models such as neural networks. For 
parameters which are relatively constant during a nominal engine firing and which exist 
primarily to detect specific failure modes (e.g., PID 1951 exists primarily to detect MCC 
bum-through), models may be developed by using data from engine anomalies or failure 
simulations. 

Results of Characteristic Modeling 

First-principle models are difficult to derive for the SSME due to the scarcity of sensors 
relative to the complexity of the engine. In taking a very conservative approach, only 7 
characteristic equations (with 30 parameter variations) could be fully justified as physically 
sound. Only one of these 7 equations failed to provide any useful predictive models 
(models 10, 11, and 12, relating pressure drop across LPFP to the square of LPFP 
SPEED). 

n.4. Summary of Work to Date 

The fundamental idea of using analytical redundancy to perform sensor data validation in 
real time on the SSME has been demonstrated by the work performed on this project 
However, while obtaining models for the majority of sensors used for control, redline, and 
health monitoring purposes appears to be straightforward, a small set of sensors may 
require extra modeling weak if they are to be kept in the validation network. 
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ITT. Guidelines for the Developme nt of SPY Models 

The TTB tests of the AREC-hosted sensor validation system demonstrated the reliability of 
using analytical redundancy for SDV. In addition, the SSME data analysis work performed 
in FY92 demonstrated that models can be derived for most of the sensors of interest, thus 
establishing that a real-time SDV system can be constructed for the SSME. This section 
presents a few guidelines which help ensure the proper construction of the analytical 
redundancy models and validation network used in an SDV system. 


TTT.l. Sensor vs. Plant Anomaly Discrimination 

There should be some guarantee that when an engine experiences an anomaly or failure, the 
validation system will not disqualify all of the sensors measuring the phenomenon when 
they suddenly start reading grossly abnormal values; this is the essence of the sensor 
versus plant anomaly discrimination problem. 

The analytical redundancy approach taken in this project can correctly handle plant vs. 
sensor failure discrimination as long as all relations used are guaranteed to hold across all 
normal operating conditions of the engine, and the validation network is structured so that 
no single engine anomaly will invalidate enough of the relations involving a particular 
sensor to disqualify that sensor. If these two conditions are maintained, then the likelihood 
of the SDV system disqualifying a sensor in response to an engine anomaly is extremely 
low; on the same order as a simultaneous multiple-point engine failure. 

For example, Figure 21 shows the sensor validation network used in previous examples. 
In this network an anomaly in either pump alone (e.g., cavitation) would not cause the 
SDV system to disqualify SI. An anomaly in the low pressure pump may invalidate R2, 
and an anomaly in the high pressure pump may invalidate R4, but both anomalies would 
need to occur simultaneously (along with a significant discrepancy between SI and S2) 
before the SDV system would disqualify SI. Such an occurrence would constitute a 
“triple-point failure” in the system, which has a very remote possibility of occurrence. 



Figure 21. Plant vs. Sensor Failure Example 
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TTT.2. Statistical Independence of Sensor F ailures 

The Bayesian approach to information fusion assumes that sensor failures are independent 
events. In actuality, there may be events which affect the status of several sensors, 
requiring changes in the Bayesian Belief Network and subsequent analyses (e.g., loss of 
an I/O board). Some initial work has been performed by De Bruyne at U.C. Berkeley to 
study this problem ? and the results indicate that the independence assumption is justified 
(i.e., that introducing events which affect several sensors into the analysis does not 
significantly affect the results). 

However, the statistical independence assumption can be violated by poor construction of 
the validation network. Figure 22. shows a worst-case example. The network is 
constructed to validate sensors SI and S2, using relations Rl, R2, and R3; cross-checking 
against each other and several other sensors (S3-S8). pi this example, SI and S2 rely 
exclusively on common information for validation. In this network, if there were a failure 
in either SI or S2, it would be impossible to determine which of them had actually failed 
(the current algorithm would fail one arbitrarily, and then continually validate the other, 
because there would not be any information to disqualify it after Rl, R2, and R3 were 
invalidated). 



Figure 22. Worst-Case Validation Network 


This problem can be avoided through careful construction of the network. However, if 
only binary relations are used, it is impossible to construct a network in which the 
independence assumption is violated (assuming that only one relation can be used between 
any pair of sensors). 


m.3. Adapting Models to New Line Replaceable Units 
As with most advanced systems, the SSME is not a static design. Components are 
continually being re-designed and improved, and in some cases completely replaced. In 
addition, engines of the same design can behave quite differently from one to another. In 
order for the sensor validation system to retain its fidelity without causing false alarms in 
the face of such changes in hardware configuration, the software must be set up so that the 
analytical redundancy models can be quickly tuned when data becomes available from these 
new configurations. 
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III.4. Summary 

The issues addressed in this section imply the following guidelines in developing analytical 

redundancy models and in configuring the validation network; 

• Models must hold over the widest possible range of normal plant behavior. This implies 
that characteristic (first principle) models should be used whenever possible, and that all 
models should be trained on as many datasets as possible. Even though empirical 
models often seem to fit SSME data with more fidelity than characteristic models, there 
is a higher degree of confidence that characteristic models will continue to hold during 
anomalous engine conditions which were not present in the training datasets used to 
derive empirical models. 

• Models with minimum cardinality (i.e., which relate the minimum number of sensors) 
should be preferred over those with higher cardinality. The lower the cardinality, the 
greater the guarantee that the statistical independence assumption will hold, and that the 
system will properly discriminate between plant and sensor failures. 

• A tool should be developed which assesses the degree to which the statistical 
independence assumption is violated for any validation network configuration. The tool 
must verify that for any single sensor failure the system must be able to: 1) uniquely 
identify the failed sensor; and 2) continue validating the rest of the sensors in the 
network. 

• The model-building software should be developed so that all models can be quickly re- 
constructed on new data following a design change or first test of a new engine. 
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IV. FY93-95 Task Description 

This section briefly describes the technical goals of the FY93-95 Real-Time Sensor Data 
Validation task, and the design extensions to the AREC-based software required to meet 
them. 


IV.l. Scope 

The primary goal of the FY93-95 task is to scale up the eight-channel sensor validation 
system developed and tested on the AREC to validate approximately 97 channels of data 
from the SSME in real-time (see Table 14.). Fundamentally, this will not require any 
changes to the run-time algorithms, or to the established methodology for developing and 
validating analytical redundancy models or for tuning and validating the network. 

rv.2. Hard Failure Det ection in Redline Sensors 

The AREC-hosted SDV system utilized a 3-of-5 multi-cycle strategy (a sensor must be 
flagged on 3 out of 5 consecutive cycles in order to be disqualified). Unfortunately, the 
SSME controller will react if a sensor is over redline on two of three consecutive cycles. 
Thus, to prevent erroneous engine shutdowns the SDV system must be able to detect 
“hard” sensor failures within two cycles for all redline sensors (at a minimum). 

The proposed approach to detecting hard sensor failures is to determine if a sensor’s rate- 
of-change has exceeded a threshold amount over two consecutive cycles (i.e., threshold on 
the ma gni tude on cycle 2 less the magnitude on cycle 0). If this condition holds, and the 
validation network flags the sensor as anomalous during each of the two cycles, then the 
sensor will be disqualified with a hard failure. For the ground test configuration, the SDV 
system will still disqualify sensors with hard failures after two consecutive anomalous 
readings, but since data is only available to ground test computers on alternate controller 
cycles the SDV system will actually be disqualifying such sensors following four controller 
cycles in which the sensor is bad. 

IV.3. Operation During Power-L evel Transients 

The AREC-based SDV system did not operate during engine start, shutdown, or power 
level transitions. The new SDV system will operate, at a minimum, on the latter of these 
transients. Thus, the system will be in continuous operation from approximately four 
seconds after mainstage has been achieved until the shutdown signal is detected 

To accomplish monitoring through mainstage power level transitions, die SDV system will 
utilize multiple sets of model thresholds and hard failure excursion thresholds. One set of 
thresholds will be used during steady-state (as in the AREC-hosted sy stem), while other 
thresholds will be used during engine transients and during the bias training period at the 
start of each steady-state interval. These transient thresholds will undoubtedly be looser 
constraints on engine behavior. While the SDV system will not be as sensitive to soft 
sensor failures during the transient in ter vals, it will still be able to catch hard failures 
following two samples of anomalous data. 

TV-4. Operation During START Transient 

As options to this task, the SDV system may be extended to monitor during the engine 
start-up transient While the basic approach to SDV is still applicable during start, the 
models required to successfully cross-check sensors may become extremely complex in 
order to take dynamic effects into account Thus, the bulk of these optional tasks will be in 
the development test and integration of new models which will utilize data trends and 
temporal information, as opposed to the steady-state models which constitute the bulk of 
the network used for mainstage. 
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Parameter 


MCC Pressure 

mWJtKMTXWT&XKW 

OPOV Actuates- Position 

40,141,176 

FPOV Actuator Position 

42,143,175 

CCV Actuator Position 

45,146,174 

MOV Actuator Position 

38,139,173 

MFV Actuator Position 

36,137,172 

HPFP Inlet Temperature 

225,226 

HPFP Inlet Pressure 

203,204 

Engine Fuel Flow 

133,253,301,251,722 

HPFTP Shaft Speed 

260,261,764 

HPFT Discharge Temperature 

231,232 

HPFP Discharge Pressure 

52,459 

FPB Chamber Pressure 

58,410 

HPFP Coolant Liner Pressure 

53,54 t 

OPB Chamber Pressure 

480 

Facility Fuel Flow 

1205,1206 

Facility LOX Flow 

1212,1213 

MCC Coolant Discharge Pressure 

17 

LPFT Inlet Pressure 

436 

LPFP Speed 

32,754 

LPOP Speed 

30,734 

HPOT Discharge Temperature 

233,234 

MCC Hot Gas Injection Pressure 

24,367,371 

MCC LOX Injection Temperature 

21,595 

MCC Coolant Discharge Temperature 

18 

LPOP Discharge Pressure 

209,210 

PBP Discharge Temperature 

93,94 

MCC Liner Cavity Pressure 

1951,1956,1957 | 

HPOP Discharge Pressure 

90,334 

PBP Discharge Pressure 

59,341 

HPFP Discharge Temperature 

659 

HPOP Intermediate Seal Purge Pressure 

211,212 

HPOT Secondary Seal Cavity Pressure 

91,92 

HPOP Balance Cavity Pressure 

327,328 

HPFP Balance Cavity Pressure 

457 

HPFP Coolant liner Temperature 

650 

Engine Fuel Inlet Pressure 

819,821,827 

Engine Oxidizer Inlet Pressure 

858,859,860 

HPOP Primary Seal Drain Pressure 

951,952,953 

HPOT Primary Seal Drain Pressure 

990 

Engine Fuel Inlet Temperature 

1021,1017,1018 

Engine Oxidizer Inlet Temperature 

1058,1054,1056 

Fuel Repress Interface Pressure 

835 

Heat Exchanger Discharge Pressure 

34,878 


Table 14. Preliminary List of SSME Sensors to Validate 
IV.5. Integr ation of Advanced Models 

Several groups are developing advanced models, such as neural networks, which relate 
data from SSME sensors. 22 * 25 Since these models appear to perform very well, even 
during power transients, they are excellent candidates for integration into the validation 
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network as long as their run-time execution is not too computationally intensive. As NASA 
provides these models, APD will test and integrate them into the system where needed to 
provide a more robust validation capability. 


IV.6. Software Devel opment and Test 

The SDV system will be ported to run on a 486 PC in the TTB blockhouse, where it will 
receive data in real-time from either live engine firings, or from playbacks of previous tests. 
APD will be able to run the system and assess its performance remotely from Sacramento 
via a network connection. The system will have a text-based display and various 
diagnostic routines to enable its performance to be thoroughly characterized. 
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V. FY93-95 Programmatics 

This section presents an expanded work breakdown structure, and a schedule for 
completion of the FY93-95 SDV task. 

V.l. Expanded Work Breakd own Structure 

Suhtask 1.0 Project Plan 

Aerojet shall deliver one copy-ready document to NASA LeRC fo r unlimited distribution, 
summarizing work done to date on real-time sensor data validation tasks under the 
Development of Life Prediction Capabilities program. The report will cover all important 
technical results, the viability of using analytical redundancy for SDV, the adequacy of 
models developed to date for performing SDV on the SSME, and results of validation tests. 
The PV-Wave and C procedures used to create the models, and the schedules, milestones 
and expanded work breakdown structure of planned FY93-95 activities will also be 
delivered to NASA LeRC 

This task will be completed upon acceptance of this report. 

Subtask 2.0 Generation of Requirements 

Aerojet shall define the detailed requirements for the sen sot data validation software. These 
requirements will include: a final list of sensors to be validated (provided by NASA LeRC); 
a table describing the accuracy and reliability (Mean-Time Between Failure) of each sensor 
to be validated; and specification of the maximum acceptable false alarm and missed 
detection rates for the system. From this information, the following will be derived and 
specified: the default model residual threshold, the minimum number of relations required 
per sensor, and the multi-cycle decision strategy. A list of the SSME test firings to be used 
for software development and validation will be specified by NASA LeRC. These 
requirements and specifications will be documented and delivered to NASA LeRC for 
approval. 

Subtask 2.1 Document MTBFs for All Sensors to be Validated 

APD will identify and document, either via in-person interviews, official documentation, or 
telecons, die reliability of all SSME sensors on the final list provided by NASA LeRC. 
Whenever possible the reliabilities shall reflect the operational reliabilities of the sensors, 
that is, hours of SSME hot-fire time between failure (where a failure is any incident which 
causes the controller to fail to receive an intended engine measurement within the stated 
accuracy of the sensor involved). 

Subtask 2.2 D erivation of SDV Parameters 

APD will compute the default model residual threshold, the minimum number of relations 
required per sensor, and the multi-cycle decision strategy based on sensor reliability data 
and design goals of 1 false alarm per 1,000 500-second firings and 1 missed detection per 
100 500-second firings. 

Subtask 13 Documentation of Requirements 

APD will deliver to NASA a document describing the reliabilities of all sensors to be 
validated, the values of all SDV parameters derived in Subtask 2.2, and the list of 
development and validation test firings to be used. 

Subtask 2.0 Deliverables 

The document produced in Subtask 2.3 will be delivered to NASA LeRC by the completion 
of this task. 
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Suhtask 3.0 Algorithm Development & V erification 

Aerojet shall perform the empirical modeling of SSME test firing data required to develop a 
robust sensor validation capability as specified in the requirements (e.g., the development 
of multi-parameter regression models as indicated by the FY92 Sensor Validation task). 
This modeling will be performed on an as-needed basis using 50 test firings, based on the 
results of Subtask 2.0 and previous modeling efforts. Advanced analytical redundancy 
models, such as neural networks, will be included and evaluated as directed by NASA. 
Aerojet shall integrate characteristic, empirical, and advanced models into a sensor 
validation network capable of meeting the confidence level specified in the requirements. 

A utility program will be written to automate fine-tuning of the residual thresholds to 
provide the maximum possible sensitivity without an unacceptable false alarm rate. 
Sensitivity is evaluated by running a simulation in which one sensor value is allowed to 
drift while all others remain nominal, and noting the point at which the system disqualifies 
the drifting sensor. The results of these sensitivity tests will be documented. Another utility 
program will be written and run to compute the biases used on the above 50 datasets. This 
information will then be used to set the bias limits. Bias limits for each relationship in the 
sensor validation network shall be reported. Aerojet shall deliver to NASA LeRC a 
complete description of each model used in the SDV network. Thresholds and bias limits 
for each model shall be included as well as information regarding the data used for model 
and threshold development If different thresholds are used during mainstage and power- 
level transitions, this will be noted and both will be given. 

Subtask 3.1 Interface Requirements for Advanced Models 

APD will document the interface requirements for advanced analytical redundancy models, 
and deliver these requirements to NASA LeRC. Advanced models will have access to 
sensor values from die current and up to four previous controller cycles, descriptors 
specifying the current engine state (including power level and lockup status), and clock 
variables indicating time since start, and time since start of the current engine state. 
Advanced models supplied by NASA must conform to the interface requirements to be 
integrated into the final SDV system. 

Subtask 3.2 V alidation Network Analysis Tool Implementation . 

A utility program will be developed which reads in a textual representation of a validation 
network and automatically outputs a report which describes: the degree of coverage for 
each sensor in the network (i.e., the number of relations it is involved in); the degree of 
overlap between every pair of sensors in the network (in terms of how many relations they 
share); the ability of the system to uniquely identify single sensor failures for each sensor in 
the network; ability to validate all other sensors following a single sensor failure for each 
sensor in the network; and tabulations of relations by sensor and by cardinality. The 
reports output by this program will be used to guide the development and refinement of the 
network. 

Subtask 3.3 Threshold Tuning Tool Implementation 

A utility program will be developed which tests the false alarm rate of the SDV system, by 
running it against several nominal test firings and noting the number of times every pair of 
relations validating a particular sensor fall at the same time. A second utility will be 
developed to test the sensitivity of the SDV system via drift tests. Results from these 
programs will be used to automate tuning of the model thresholds. Thresholds will be 
derived for steady-state and transient operating modes. 

Subtask 3.4 Bi as Tuning Tool Implementation 

A utility program will be developed which derives the Was limits for each model based on 
analysis of the training test data. 
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Subtask 3.5 Hard Failure Threshold Tuning Tool Implementation 
A utility program will be developed which derives the maximum allowable excursion each 
redline sensor can make in two consecutive samples under nominal and anomalous 
operating conditions. This information will be used to set the hard-failure threshold limits. 

Subtask 3.6 Data File Preparation 

APD will establish a library of the 50 training and 50 test datasets required for the SDV 
task. All datasets may be stored in a compressed format, and the training datasets may be 
stored in a reduced format for ease of handling. Software will be implemented to facilitate 
automatic access of the data by the various utility programs. 

Subtask 3.7 SDV Model & Network D evelopment 

APD will utilize the utilities described above to develop a robust sensor validation capability 
as specified. New models will be developed as needed in order to meet the error-rate 
objectives specified in the requirements. 

Subtask 3.8 Test & Integration of Advanced Models 

Advanced models supplied by NASA LeRC will be evaluated for possible inclusion into 
the SDV network. Evaluation shall consist of determining the added coverage to sensors in 
the network, and the increase in system sensitivity possible without generating false alarms 
on the training datasets. After reporting these results to NASA LeRC, APD will, at NASA 
LeRC's direction, integrate the models into the final SDV system. 

Subtask 3.9 Documentation 

APD will document all models and associated parameters used in the final SDV network. 
The performance of the final network (sensitivity and false alarm rates) will also be 
documented and delivered to NASA LeRC. 

Subtask 3.0 Deliverables 

The document produced in Subtask 3.9, in addition to the documented source code for all 
utility programs, will be delivered to NASA LeRC by the completion of this task. 


Subtask 4.0 Software Development and Test 

After receipt of all available docum entat ion describing the PC hardware and software 
located at NASA MSFC for reading TTBE data in real-time. Aerojet shall produce and 
deliver to NASA LeRC detailed specifications for the sensor validation software. After the 
specifications are approved by NASA LeRC, Aerojet shall design, devel op, and module 
test the complete sensor validation software system to be used at the TTB site. The sensor 
validation system will include a text-based user interface with real-time displays indicating 
the status of the system and highlighting any failed sensors. The system will also have the 
capability of archiving data including: samples from selected sensors (e.g, MCC PC); times 
of sensor failures or near-failures (e.g., one-cycle failures); and selected diagnostic 
information such as whether a particular model holds or not on each engine cycle. The 
system will have the capability of being executed and monitored remotely from the 
contractor's site. 

Subtask 4.1 Software Specifications 

APD shall produce and deliver to N ASA LeRC software specifications for the SDV system 
to be installed on the PC at the TTB site. 

Subtask 4.2 Core Validation System 

APD shall design, implement, and module test the core SDV system software on a PC 
platform. 
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Subtask 4.3 Data Interface 

APD shall design, implement, and module test routines to access data fed from the TTB 
blockhouse in real time on a PC platform. 

Subtask 4.4 User Interface . Jt , , . , , .. . . 

APD shall design, implement, and module test routines to display (via a text-based display) 
and log system status and error messages on a PC platform. This software will feature real- 
time displays indicating the status of the system and highlighting any failed sensors. The 
software will also have the capability of archiving data including: samples from selected 
sensors (e.g, MCC PC); times of sensor failures or near-failures (e.g., one-cycle failures); 
and selected diagnostic information such as whether a particular model holds or not on each 
engine cycle. 

Subtask 4.5 Remote Operation 

APD shall design, implement, and module test routines to allow personnel at APD s 
Sacramento facility and at NASA LeRC to configure, run, monitor, and extract results from 
the SDV system installed at the TTB facility. 

Subtask 4.6 I ntegration . 

APD shall integrate all software rout ines into the final SDV system on a PC platform, 
compatible with the 486 PC at the TTBE facility. 

Subtask 4.0 D eliverables .... 

The software specifications produced in Subtask 4.1, in addition to the documented source 
code for all software developed, will be delivered to NASA LeRC by the completion of this 
Subtask. 

Subtask 5.0 Verification and -Validation , . 

Aerojet shall install and test the sensor validation soft ware on the PC located at the TTB 
site. All functions of the software shall be tested with TTBE data playbacks. The remote 
execution function shall be tested to ensure that Aerojet is able to control and evaluate 
execution of the system from computers at Aerojet Propulsion Division in Sacramento, 
California. 

Aerojet will s uppo rt the validation of the SDV system through a combination of at least 20 
playback live TTBE firings via remote operation from Sacramento. 

Subtask 5. 1 Installation and Standalone Tests 

APD will install the SDV system on the 486 PC at the TTB facility. The software operation 
will be verified through stand-alone system tests. The remote operation capability will be 
tested and verified. 

Subtask 5.2 TTBE Playback Tests . . 

APD will validate t he op eration of the S DV th rough successful on-site monitoring of at 
least one playback of TTB firing data at the TTB facility. 

Snhtask 5.3 Ti'BE Validation Tests 

Aerojet will sup port t he validation of the SDV system through a combination of at least 20 
playback or live TTBE firings via remote operation from Sacramento. 

Subtask 5.0 Deliverables 

APD will deliver a document summarizing the results of all live and playback TTBE tests 
of the SDV system by the completion of this Subtask. 
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Subtask 6.0 Documentation & Deliverables 

Aerojet shall deliver to NASA LeRC final specification, source code and data flow 
diagrams for the delivered sensor v alida tion system. Aerojet will also deliver a user's 
manual for the system installed at TTB. A final report documenting the development 
activities and functionality of the sensor validation system a nd the results of t he validati on 
tests will be prepared and delivered to NASA LeRC. Presentation of these results will be 
made at NASA LeRC and at NASA MSFC. Recommendations for continued sensor 
validation system development, including requirements for developing a flight-capable 
system, will be made and delivered based upon the demonstrated capabilities of the SDV 
system. 

Subtask 6.1 User's Manual 

APD shall deliver to NASA LeRC a user's manual for the software installed at the TTB 
site. The manual shall cover all aspects of the system’s operation including remote 
operation procedures. 

Subtask 6.2 Software Documentation 

APD shall deliver to NASA LeRC documentation for all developed software, including 
documented source code, flow charts, and design documents. 

Subtask 6.3 Final Report 

APD shall d eliver to NASA LeRC a final report describing the development activities, 
results of the TTB validation tests, and suggestions for future work. 

Subtask 6.4 Presentations 

Presentation of the results documented in the final report will be made at NASA LeRC and 
at NASA MSFC. 

Subtask 6.0 Deliverables 

APD shall deliver the documentation produced in Subtasks 6.1 - 6.3 to NASA LeRC by the 
completion of this Subtask. 

Subtask _7.0 (Option 1) 

At the discretion of the NASA LeRC Task Manager, the sensor validation system will be 
extended to monitor approximately 25 of the 97 sensors in Attachment A during the startup 
transient. The software will be configured so as to provide continuous coverage of these 25 
sensors from engine start until shutdown. Parameter models and model thresholds will be 
provided to Aerojet by NASA LeRC. Aerojet shall evaluate the sensitivity of these models 
with the same 50 training test firings used for mainstage model development and shall 
integrate these models into the sensor validation system. The results of the sensitivity test 
shall be documented and delivered. The same 50 test firings used to validate the mainstage 
portion of the system will be used to validate the sensor validation system during the start 
transient System performance will be documented and delivered as previously described 
for mainstage. 


42 


Sabtask. 8.0 (Qptioa.2} 

At the discretion of the NASA LeRC Task Manager, the sensor validation system will be 
extended to monitor approximately 25 of the 97 sensors in Attachment A during the startup 
transient The software will be configured so as to provide continuous coverage of these 25 
sensors from engine start until shutdown. Aerojet shall develop parameter models and 
model thresholds using the same 50 test firings used for mainstage model development A 
complete description of each model used in the SDV network shall be delivered; as well as 
information regarding the data used for model and threshold development Aerojet shall 
evaluate the sensitivity of these models with the same 50 test firings used for mainstage 
model development and shall integrate these models into die sensor validation system. The 
results of the sensitivity tests shall be documented and delivered. The same 50 test firings 
used to validate the mainstage portion of the system will be used to validate the sensor 
validation system during die start transient System performance will be documented and 
delivered as previously described for mainstage. 


V.2. Schedule & Milestones 

Figure 23 oudines the projected schedule for the FY93-FY95 Real-Time SDV task. 
Optional subtasks 7.0 and 8.0 were intentionally omitted from the schedule. A decision 
regarding their implementation should be made by May 1, 1994, at which time tasks 3.8 - 
6.4 will be delayed (into FY95) to accommodate. 
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Binary relation, Linear fit coefficients. (Page 1 of 4) 


PidY 

PidX R.Mean 

R. Sigma 

CO 

Cl 
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-6 . 2050E+03 

4 . 3120E+02 
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1. 3118E+04 
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129 
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8 . 6613E+01 
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9.0918E-01 

129 
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6.7443E-01 

52 

17 -1.92E+00 
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58 
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58 
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5.29E+01 

1.1263E+03 
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17 
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17 
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17 
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436 

17 -1.42E+00 
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Binary relation. Linear fit coefficients. (Page 2 of 4) 


PidY 
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: R.Mean 
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233 

30 

1.33E+00 

5.10E+01 

— 1 . 4766E+01 

2.6332E-01 

233 

480 

-1.05E+00 

5.96E+01 

6 . 2909E+02 

1. 3880E-01 

233 

40 

2.81E-01 

4.97E+01 

-2 . 4230E+02 

2 . 3993E+01 

234 

30 

1.12E+00 

4.64E+01 

-6.9329E+01 

2.7362E-01 

234 

480 

-7.10E-01 

5.33E+01 

5.9808E+02 

1.4443E-01 

234 

40 

2.57E-01 

4.24E+01 

-3 . 0831E+02 

2.4967E+01 

24 

129 

-5.71E+01 

1.57E+03 

-4 . 8986E+01 

6.2460E-01 

24 

53 

-5.83E+01 

1.58E+03 

-8.7063E-01 

5. 5505E-01 

24 

722 

-5.47E+01 

1.57E+03 

-4 . 5360E+01 

1.2042E-01 

21 

93 

-1.75E-02 

8.46E-01 

3 . 1736E+01 

7 . 8683E-01 

21 

30 

1.69E-02 

2.56E+00 

1.2681E+02 

1 . 2964E-02 

21 

40 

-1.77E-02 

2.47E+00 

1 . 1417E+02 

1.2033E+00 

176 

30 

2.44E-02 

1. 39E+00 

1. 1929E+01 

1. 0457E-02 

176 

480 

-8.59E-03 

1.37E+00 

3 . 7404E+01 

5. 5188E-03 

176 

129 

-1.21E-03 

1.45E+00 

3 . 0733E+01 

1.1367E-02 

40 

30 

1.88E-02 

1.39E+00 

1 . 0920E+01 

1.0693E-02 

40 

129 

-9.07E-03 

1.47E+00 

3.0123E+01 

1.1632E-02 

40 

480 

— 1. 68E-02 

1.38E+00 

3 . 6940E+01 

5. 6492E-03 

18 

225 

1.91E-01 

1.84E+01 

-3.6711E+00 

1.0352E+01 

18 

1017 

5 . 43E-02 

2.03E+01 

2 . 3863E+01 

1. 1029E+01 

18 

21 

4.18E-01 

1.97E+01 

2 . 3024E+02 

1.0653E+00 

209 

327 

-9.40E-02 

2.60E+01 

1.9806E+02 

- 5. 0211E-02 

209 

858 

1. 68E-01 

2.43E+01 

2.7952E+02 

7 . 6803E-01 

209 

234 

-2.06E400 

3 . 09E+01 

2 * 3312E+02 

8. 6073E-02 

93 

21 

5.70E-03 

1.08E+00 

-3.7547E+01 

1.2565E+00 

93 

40 

-1.36E-02 

2.71E+00 

1.0284E+02 

1.5595E+00 

93 

30 

4.56E-02 

2 . 62E+00 

1. 1870E+02 

1. 6902E-02 

1951 

990 

—2 . 28E-02 

6.71E-01 

-I * 1034E+01 

1.4558E-01 

1951 

91 

1. 45E-02 

7.56E-01 

— 1. 3815E+01 

3 . 2514E-01 

1951 

819 

-1.46E-02 

7.88E-01 

-1.1119E+01 

1.3328E-01 

90 

328 

1 . 08E-02 

1.38E+01 

4 . 0283E-01 

9.9949E-01 

90 

129 

5.78E-01 

1.99E+01 

-5.5293E+02 

1 . 4817E+00 

90 

480 

-1.51E+00 

2.77E+01 

3.1915E+02 

7. 1907E-01 

59 

480 

-1.88E+00 

5. 83E+01 

2 . 8383E+02 

1.3604E+00 

59 

90 

5.93E-01 

7.45E+01 

-3.1455E+02 

1. 8905E+00 

59 

328 

7.53E-01 

7.27E+01 

-3.1504E+02 

1.8899E+00 

659 

764 

1.69E-02 

1.40E+00 

1.4823E+01 

2 . 3099E-03 

659 

722 

1.10E-02 

1.69E+00 

4 . 4922E+01 . 

. 3. 1499Er03. 

659 

52 

-2.42E-02 

1.96E+00 

4 . 6531E+01 

8 . 0671E-03 

211 

231 

-1.97E-01 

1.41E+01 

-4 . 7988E+01 

1. 8014E-01 

211 

232 

1.41E-01 

1.35E+01 

4 . 9194E+01 

1. 2016E-01 

211 

175 

-7 . 03E-01 

1.45E+01 

7.4020E+01 

2.2898E+00 

91 

990 

-2.26E-02 

1.02E+00 

8 . 6122E+00 

4.3815E-01 

91 

1951 

1.35E-01 

1.96E+00 

3 . 5978E+01 

2.4138E+00 

91 

211 

1. 08E-01 

2 . 19E+00 

3.1310E+01 

-7.4056E-02 

225 

1017 

-5.15E-04 

2.83E-01 

1. 2148E+00 

1.1038E+00 

225 

1021 

6.28E-03 

3 . 61E-01 

3 . 4968E+00 

1. 0409E+00 

225 

18 

-1.79E-01 

1.32E+00 

9 . 9661E+00 

7 * 4869E-02 

327 

129 

2 . 06E+00 

8.70E+01 

-1.9390E+02 

1 . 0446E+00 

327 

334 

1.33E+00 

8.89E+01 

1.9670E+02 

7 . 0458E-01 

327 

480 

3.63E-01 

9 . 37E+01 

4 . 2494E+02 

5 . 0615E-01 
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.Binary relation, Linear fit coefficients. (Page 3 of 4) 


PidY 

PidX R.Mean 

R. Sigma 

CO 

Cl 

457 

52 -1.86E+00 

5.62E+01 

6.6748E+01 

7 . 7542E-01 

457 

436 — 1. 22E+00 

7.00E+01 

-6 . 1733E+01 

1. 0980E+00 

457 

17 -3.15E+00 

1.03E+02 

-5 . 5721E+01 

1.0830E+00 

650 

764 -1.25E+00 

3.07E+01 

1.8714E+02 

3 . 1693E-03 

650 

659 -8.56E-01 

2.98E+01 

1.6523E+02 

1. 3845E+00 

650 

232 5.69E-01 

3.01E+01 

1.0854E+02 

1. 0850E-01 

819 

436 9.10E-02 

4.55E+00 

3 . 1860E+01 

-4 . 9651E-03 

819 

231 3.39E-02 

5.38E+00 

8.7912E+01 

-4.5901E-02 

819 

1951 1.28E-01 

4.46E+00 

5 . 5747E+01 

4 . 6345E+00 

858 

209 1.46E+00 

2.27E+01 

-1.6778E+02 

7 . 2514E-01 

858 

951 1.94E+03 

1.98E+03 

-7.9473E+01 

— 2.6943E+02 

858 

40 — 4.27E-01 

3.06E+01 

1 . 8579E+02 

-1.5994E+00 

951 

211 -1.69E-02 

7.36E+00 

5 . 5833E+00 

4.0491E-03 

951 

209 8.33E-03 

7.36E+00 

6 . 543 1E+00 

1.1546E-04 

951 

1951 -3.97E-03 

7.36E+00 

6 . 0043E+00 

-6.1257E-02 

990 

91 5.61E-02 

2.34E+00 

-1.8480E+01 

2.2000E+00 

990 

1951 2.15E-01 

4.05E+00 

6 . 3054E+01 

5.5542E+00 

990 

1190 -5.88E-01 

6.37E+00 

-7.6084E+01 

9.5423E-02 

1021 

225 1.11E-02 

3.06E-01 

2 . 8014E+00 

8 . 1476E-01 

1021 

18 -1.20E-01 

1.19E+00 

1.2327E+01 

5.7721E-02 

1021 

231 -5.87E-02 

6.77E-01 

3.0702E+01 

3.9803E-03 

1017 

225 8.70E-03 

2.38E-01 

1.7168E+00 

8 . 3921E-01 

1017 

18 -1.31E-01 

1.23E+00 

1 . 0777E+01 

6. 1194E-02 

1017 

231 -5.58E-02 

6.64E-01 

2.8566E+01 

5. 2249E-03 

1058 

21 2.43E-02 

2.38E+00 

1.1720E+02 

2.5016E-01 

1058 

93 4 . 57E-03 

2 . 52E+00 

1 . 3049E+02 

1.7063E-01 

1058 

1190 1.38E-01 

2.78E+00 

1.4905E+02 

1.7657E-02 

1054 

21 2.14E-02 

2.36E+00 

1. 1701E+02 

2.4935E-01 

1054 

93 1.29E-03 

2.50E+00 

1.3023E+02 

1.7014E-01 

1054 

1190 1.36E-01 

2.77E+00 

1.4904E+02 

1.7275E-02 

1188 

21 -1.37E-01 

3.35E+01 

1.8923E+02 

3 . 0263E+00 

1188 

1951 -1.16E+00 

3.86E+01 

7 . 3597E+02 

—3 . 6771E+00 

1188 

990 -3.50E-01 

3.74E+01 

7 . 6758E+02 

3.2966E-01 

1190 

233 5.03E-01 

5.49E+01 

5.4257E+02 

2 .7825E-01 

1190 

990 1.07E+00 

5.75E+01 

8 . 5214E+02 

5. 4148E+00 

1190 

93 -8.27E-01 

5.77E+01 

1 . 3575E+02 

3.7909E+00 

835 

722 -1.78E+00 

6.36E+01 

2 . 8361E+01 

2.0371E-01 

835 

436 -3.83E+00 

6.90E+01 

4 . 2789E+01 

7.3953E-01 

835 

17 -5.71E+00 

8.47E+01 

4.777 8E+01 

7.2934E-01 

764 

659 -1.93E+01 

6.05E+02 

—6 . 2031E+03 

4 . 3075E+02 

764 

17 -1.98E+01 

4.49E+02 

1.3093E+04 

4 . 8965E+00 

764 

133 -4.06E+00 

2.56E+02 

1 . 3057E+04 

1 . 3609E+00 

175 

42 1.35E-03 

1.35E-01 

1.1699E+00 

9.7916E-01 

175 

764 2.34E-02 

1.08E+00 

2.5494E+01 

1.5668E— 03 

175 

133 1.34E-02 

1.28E+00 

4 . 6224E+01 

2 . 1146E— 03 

722 

371 -7.66E+00 

1. 10E+02 

5 . 5275E+02 

4 . 7008E+00 

722 

764 -6.05E-01 

1.86E+02 

-9 . 2833E+03 

7.2534E-01 

722 

17 -1.47E+01 

3.26E+02 

1. 1569E+02 

3 . 5746E+00 

1205 

371 -5.80E+00 

1.39E+02 

3 . 8688E+02 

4 * 6454E+00 

1205 

17 -1.22E+01 

3.11E+02 

-4.2931E+01 

3 . 5318E+00 

1205 

764 1.01E+00 

1.97E+02 

-9 . 3276E+03 

7 . 1663E-01 
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.Binary relation, Linear fit coefficients. (Page 4 of 4) 


PidY 

PidX 

R.Mean 

371 

129 

5.36E-01 

371 

722 

1.30E+00 

371 

53 

1.51E-01 

328 

334 

-1.31E-07 

328 

480 

-1.49E+00 

328 

129 

5.73E-01 

334 

328 

-1.31E-07 

334 

480 

-1.49E+00 

334 

129 

5.73E-01 


R. Sigma CO 


1.68E+01 -1.1456E+02 
2.33E+01 -1. 1577E+02 
2.40E+01 -1.9540E+01 
4.00E-06 8 . 1380E-05 
2.63E+01 3 . 1971E+02 
2.41E+01 -5.5152E+02 
4.00E-06 8.1380E-05 
2.63E+01 3.1971E+02 
2.41E+01 -5.5152E+02 


Cl 


1.0992E+00 
2 . 1263E-01 
9.7305E-01 
1.0000E+00 
7 . 1927E-01 
1.4818E+00 
1.0000E+00 
7.1927E-01 
1.4818E+00 
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Binary relation, cubic fit coefficients. (Page 1 of 3) 

PidY PidX R.Hean R.Sigma CO Cl C2 C3 


260 

659 

260 

17 

260 

133 

231 

42 

231 

260 

231 

133 

232 

42 

232 

260 

232 

133 

129 

53 

129 

371 

129 

90 

52 

17 

52 

436 

52 

457 

53 

129 

53 

371 

53 

52 

480 

334 

480 

328 

480 

59 

58 

480 

58 

59 

58 

52 

42 

175 

42 

764 

42 

133 

203 

32 

203 

93 

203 

764 

1212 

334 

1212 

129 

1212 

480 

133 

371 

133 

17 

133 

764 

17 

436 

17 

52 

17 

764 

436 

17 

436 

52 

436 

764 

32 

764 

32 

722 

32 

436 

30 

129 

30 

59 

30 

1212 

233 

30 

233 

480 

233 

40 


1.35E+01 
-2.526+01 
-1.796+01 
-3.026+00 
-1.56E+00 
-2.336+00 
-3.186+00 
-1.14E+00 
-2.056+00 
-2.186-01 
-8.46E-01 
-5.466-02 
-4.516+00 
-1.706+00 
3.84E+00 
1.766-01 
-8.226-01 
1.106+00 
1.106+00 
1.10E+00 
9.86E-01 
-4.866+00 
-3.04E+00 
* 1.336+00 
3.55E-04 
-2.29E-02 
-7.68E-02 
-4.976-01 
4.296-03 
-1.226-01 
-3.766-01 
9.71E-01 
-6.29E-01 
-6.24E+00 
2.33E+00 
1.566+00 
1.15E+00 
1.896+00 
2.406+00 
-9.376-01 
7.756-01 
1.17E+00 
-1.37E+01 
-1.92E+01 
-3.326+01 
-3.94E+00 
-7.036+00 
•5.85E+00 
2.206+00 
-3.296+00 
-2.626-01 


5.316+02 
5.136+02 
2.82E+02 
6.126+01 
6.246+01 
6.07E+01 
4.496+01 
4.606+01 
4.486+01 
1.876+01 
1.466+01 
1.12E+01 
1.146+02 
7.69E+01 
6.236+01 
2.166+01 
2.496+01 
4.166+01 
3.306+01 
3.306+01 
4.21E+01 
8.296+02 
8.94E+01 
1 .016+02 
1.33E-01 
9.496-01 
1.196+00 
7.236+00 
9.686+00 
9.12E+00 
3.546+01 
4.696+01 
4.856+01 
1.196+02 
2.666+02 
1.086+02 
3.726+01 
7.516+01 
7.696+01 
4.306+01 
5.266+01 
5.206+01 
2.096+02 
2.276+02 
1.746+02 
6.426+01 
6.29E+01 
6.44E+01 
4.766+01 
5.936+01 
5.07E+01 


5.5961E+04 -2.01926+03 
-2.871 1E+04 3.80196+01 
-4.37766+04 1.4238E+01 
-2.30296+03 1.2953E+02 
-4.5641E+03 5.5106E-01 
-5.9086E+03 1.66156+00 
1.6693E+03 -6.92596+01 
-2.4493E+03 3.03386-01 
-5.8292E+03 1.59986+00 
7.8807E+01 8.35726-01 
-2.04996+02 1.21466+00 
-5.07356+02 1.4235E+00 
1.09666+02 1.30206+00 
-5.7425E+02 1.8940E+00 
2.07246+03 -5.26016-01 
1.04336+02 9.52816-01 
-1.6735E+02 1.2470E+00 
2.3596E+03 -1.0039E+00 
5.10026+02 6.58286-01 
5.10026+02 6.58286-01 
7.34746+02 3.1814E-01 
3.39216+01 1.0747E+00 
5.3222E+02 4.9761E-01 
6.82276+03 -3.69926+00 
1.12906+01 4.73836-01 
-1.9457E+02 2.45186-02 
-1.77096+02 5.42246-02 
•5.1272E+02 1.47006-01 
5.37416+02 -9.4565E+00 
-5.6975E+02 7.0941E-02 
•6.43746+02 2.4473E+00 
1.14166+03 5.80406-01 
•4.72436+02 1.94586+00 
•4.68476+02 5.8328E+00 
1.09846+04 -5.95096+00 
4.12216+04 -4.12706+00 
•3.6763E+02 1.32386+00 
2.9022E+02 5.38606-01 
9.1963E+03 -8.81386-01 
5.63356+02 5.16306-01 
6.9704E+02 2.7727E-01 
9.26766+03 -8.88596-01 
-2.9704E+04 3.8171E+00 
-3.86036+04 1.1361E+01 
-3.0802E+04 3.4497E+01 
-3.96986+03 7.72786+00 
-1.93246+03 2.5453E+00 
•4.43506+03 4.3244E+00 
-1.7848E+03 1.73286+00 
1.55686+02 5.19306-01 
2.4817E+03 -1.3841E+02 


3.14816+01 -1.32296-01 
-8.5447E-03 7.22066-07 
-9.5189E-04 2.30596-08 
-1.5203E+00 6.56106-03 
-1.67666-05 1.7516E-10 
-1.21706-04 2.96946-09 
1.56636+00 -8.65066-03 
-7.77626-06 7.20326-11 
-1.14836-04 2.77026-09 
3.86606-05 -6.84996-09 
-9.49456-05 9.40726-09 
-2.0321E-04 1.77996-08 
-9.05206-06 3.75036-09 
-1.67536-04 1.81346-08 
4.96386-04 -4.40536-08 
4.3807E-05 -2.54436-09 
-8.28006-05 1.0171E-08 
3.37986-04 -2.3692E-08 
1.71646-04 -1.21696-08 
1.7164E-04 -1.21696-08 
5.7192E-05 -2.44766-09 
-3.3212E-05 2.89866-09 
1.90426-05 -2.4454E-10 
9.36296-04 -6.1404E-08 
7.89426-03 -3.75086-05 
-7.86766-07 8.88406-12 
-3.96766-06 9.89516-11 
-1.04456-05 2.60276-10 
6.5840E-02 -1.32336-04 
-2.19636-06 2.3413E-11 
-3.2341E-04 2.89476-08 
4.9687E-04 -6.17686-08 
-2.05426-04 1.28706-08 
-4.19586-04 5.19646-08 
2.7134E-03 -2.51496-07 
1.53766-04 -1.60926-09 
-8.45966-05 7.57186-09 
5.03986-05 -4.20656-09 
3.27396-05 -3.25746-10 
1.2890E-04 -1.1547E-08 
1.00476-04 -7.48396-09 
3.28986-05 -3.27646-10 
-1.1790E-04 1.30926-09 
-8.2564E-04 2.04266-08 
-8.96436-03 7.99356-07 
-2.49456-03 3.07176-07 
-3.5216E-04 1. 87006- 08 
-7.35846-04 4.73086-08 
-3.83156-04 3.18886-08 
-9.75296-05 8.04316-09 
3.11346+00 -1.93386-02 
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Binary relation, cubic fit coefficients. (Page 2 of 3) 

Pldf PidX R.Mean R. Sigma CO Cl C2 C3 


234 30 

234 480 

234 40 

24 129 

24 53 

24 722 

21 93 

21 30 

21 40 

176 30 

176 480 

176 129 

40 30 

40 129 

40 480 

18 225 

18 1017 

18 21 
209 327 

209 858 

209 234 

93 21 

93 40 

93 30 

1951 990 
1951 91 

1951 819 
90 328 

90 129 

90 480 

59 480 

59 90 

59 328 

659 764 

659 722 

659 52 

211 231 

211 232 

211 175 


1.03E+00 
-3.606*00 
•1.206*00 
-5.616*01 
-5.936*01 
-5.50E+01 
-2.15E-02 
-8.44E-02 
1.316-01 
-7.89E-02 
•1.48E-01 
-1.196-01 
-8.306-02 
-1.26E-01 
-1.55E-01 
5.986*00 
2.756*01 
3.266*01 
-7.07E+00 
-1. 136*00 
1.906*01 
5.04E-02 
2 . 206*01 
-6.69E-02 
-7.19E-02 
-5.40E-02 
-4.996-02 
-2.81E-02 
1. 806-02 
-6.14E-01 
-1.186*00 
-4.40E-01 
-2.63E-01 
-1.586-02 
-6.156-02 
-1.096-01 
-6.496*00 
-1.016*00 
-6.726-01 


4.23E+01 

5.306*01 

4.196*01 

1.576*03 

1.58E+03 

1.576*03 

5.52E-01 

1.61E+00 

1.47E+00 

1.186*00 

1.166*00 

1.14E+00 

1.166+00 

1.176*00 

1.196*00 

2.066*01 

4.506*01 

2.016*01 

3.126*01 

2.246*01 

4.496*01 

7.31E-01 

1.896*00 

1.826*00 

6.126-01 

6.24E-01 

7.296-01 

1.396*01 

1.646*01 

5.626*01 

7.316*01 

7.596*01 

7.37E+01 

1.406*00 

1.74E+00 

2.086+00 

1.866+01 

1.36E+01 

1.44E+01 


91 990 
91 1951 
91 211 
225 1017 
225 1021 
225 18 
327 129 
327 334 
327 480 
457 52 
457 436 
457 17 
650 764 
650 659 
650 232 


-7.176-02 
-3.436-01 
6.576-02 
-4.816-01 
1.236-01 
1.166+00 
3. 176+00 
2.986+00 
4.26E+00 
-3.436*00 
-4.076*00 
•8.306+00 
-1.176*00 
-5.726-02 
-2.176*00 


1.006*00 

1.396*00 

2.246*00 

9.276-01 

3.90E-01 

8.796-01 

8.80E+01 

8.916*01 

9.266*01 

5.33E+01 

7.006+01 

1.106+02 

3.026+01 

3.04E+01 

3.006+01 


-2.1335E+03 2.04276*00 
9.09386*01 5.74806-01 
2.3131E+03 -1.25276*02 
-9.9506E+02 1.73556*00 
-2.24506+03 3.04966+00 
-1.91566*03 5.51066-01 
-1.2234E+02 3.15516+00 
-6.04396+02 5.04276-01 
-1.9252E+02 1.42416*01 
-2.20986+02 1.88636-01 
-2.40656*01 5.60796-02 
-1.2116E+02 2.05346-01 
-2.10196*02 1.81366-01 
-1.14906*02 1.97676-01 
-2.22466*01 5.45516-02 
4.1932E+04 -3.96386*03 
2. 8680 E* 05 -3.09606*04 
2.64176*02 -5.09696*00 
-2.72636*03 3.74676*00 
2.67406*02 2.24436*00 
2.92396+03 -9.15146*00 
2.56266+02 -4.0273E+00 
-1.1637E+02 9.66296*00 
-5.9377E+02 5.0027E-01 
-9.55086*00 -1.3007E-01 
3.65096+00 -2.7187E+00 
-8.14446*00 -3.03346-01 
-2.85346+02 1.27036*00 
1.46136*03 -7.20886-01 
-2.64076*02 1.07696*00 
•3.26446*02 1.66326*00 
1.2716E+03 3.51986-01 
6.6017E+02 9.41406-01 
-1.11286*02 1.56496-02 
-1.7074E+02 5.31446-02 
-9.89786*01 9.55996-02 
-1.25396*03 3.30926*00 
•7.9941E+02 2.02146*00 
-8.78936*02 4.69986*01 
9.73116*00 1.4153E-01 
-5.05256*01 -3.1115E+01 
-1.47486*02 2.1704E+00 
-1.16106*04 1.25226*03 
1 .44496*03 -1.54666*02 
3.28636+02 -3.02186*00 
1 .3403E+03 -9.18086-01 
-1.79796*02 8.9507E-01 
9.47096*01 5.74556-01 
-1.3671E+03 1.73576*00 
•2.0691E+03 3.0080E+00 
-1.38486+03 2.40026+00 
-5.21886*02 6.2184E-02 
-2.00716*02 8.47356*00 
-3.87526*02 1.05476+00 


-4.7224E-04 4.0038E-08 
-1.1620E-04 1.00246-08 
2.7935E+00 -1.69276-02 
-4.2692E-04 5.3792E-08 
-9.0553E-04 1.0751E-07 
-3.24136-05 7.9940E-10 
-1.1912E-02 1.96306-05 
-1.08986-04 7.9870E-09 
-1.77556-01 7.64506-04 
-4.41766-05 3.5617E-09 
-1.33236-05 1.12716-09 
-8.0574E-05 1.08896-08 
-4.26016-05 3.45256-09 
-7.75796-05 1.05196-08 
-1.29366-05 1.09776-09 
1.17806*02 -1.11796*00 
1.04556*03 -1.12956*01 
6.52346-02 -1.77256-04 
-1.52326-03 2.0500E-07 
-2.88676-02 1.44466-04 
9.71306-03 -3.2205E-06 
3.08246-02 -5.87186-05 
-8.69116-02 2.19876-04 
-1.08226-04 8.00116-09 
1.2752E-02 -1.62826-04 
1.66426-01 -2.84646-03 
9.66336-03 1.62556-04 
-8.31256-05 8.30406-09 
7.80026-04 -9.00496-08 
-6.6233E-05 3.66336-09 
-5.4177E-05 -2.36356-10 
4.8387E-04 -4.94416-08 
2.9921E-04 -3.06616-08 
-4.62846-07 5.2739E-12 
-3.78586-06 9.3875E-11 
-1.71686-05 1.10266-09 
-2.50266-03 6.35976-07 
-1.37396-03 3.22956-07 
-6.7726E-01 3.3387E-03 
2.32446-02 -4.87566-04 
-4.20916*00 -1.72386-01 
-9.24306-03 1.2508E-05 
-4.2104E+01 4.53276-01 
5.26206*00 -5.69366-02 
9.31826-03 -8.93166-06 
8.1771E-04 -1.10886-07 
-6.1215E-06 -4.38036-09 
2.9481E-05 -5.81286-09 
-2.0863E-04 1.46906-08 
-5.85646-04 5.78806-08 
-4.16026-04 4.19596-08 
-1.56756-06 1.31486-11 
-1.41116-02 -2.0992E-04 
-6.0285E-04 1.28686-07 
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.Binary relation, cubic fit coefficients. (Page 3 of 3) 

PidY PidX R.Mean R. Sigma CO Cl C2 C3 


819 436 2.22E-01 4.60E+00 2.4788E+02 -1.8874E-01 5.1099E-05 -4.6515E-09 
819 231 1.13E-01 5.45E+00 -4.9176E+02 1.1084E+00 -7.4935E-04 1.5923E-07 
819 1951 9.51E-01 7.18E+00 -1.8709E+01 -9.9403E+00 -3.1916E-02 6.9183E-02 
858 209 7.86E-01 1.92E+01 3.9170E+02 -1.6913E+00 -1.8672E-04 7.0389E-06 
858 951 -6.65E+07 7.47E+08 -1.7269E+05 4.6997E+04 -5.3051E+03 4.6228E+04 
858 40 1.08E+01 3.56E+01 2.4681E+03 -1.5689E+02 3.2419E+00 -2.1413E-02 
951 211 -7.66E-03 7.36E+00 -2.2714E+01 3.5844E-01 -1.4698E-03 2.0190E-06 
951 209 1.56E-02 7.35E+00 -1.8438E+01 2.1580E-01 -6.1634E-04 5.8292E-07 
951 1951 -3.84E-02 7.39E+00 7.9617E-01 -2.1525E+00 -2.7240E-01 -1.1562E-02 
990 91 1.95E-02 2.21E+00 -5.5124E+00 6.8782E-01 2.3851E-02 9.7821E-04 
990 1951 -1.26E+00 3.77E+00 -1.4806E+02 -8.1164E+01 -1.1513E+01 -4.9631E-01 
990 1190 -4.71E+00 1.14E+01 -6.1933E+02 2.8271E+00 -4.0396E-03 1.8606E-06 
1021 225 -1.22E-01 3.07E-01 -2.4361E+03 2.3016E+02 -6.7423E+00 6.3436E-02 
1021 18 -1.01E-01 1.13E+00 -2.7493E+02 2.4063E+00 -6.0037E-03 4.8780E-06 
1021 231 -3.1 IE-01 5.41E-01 -2.0728E+02 4.9951E-01 -3.3663E-04 7.5003E-08 
1017 225 7.43E-02 1.70E-01 -5.5525E+02 5.2694E+01 -1.5079E+00 1.4024E-02 
1017 18 1.28E-01 3.43E-01 -7.1942E+01 6.0564E-01 -1.0323E-03 4.9995E-07 
1017 231 -1.92E-01 4.38E-01 -1.5554E+02 3.7560E-01 -2.4401E-04 5.2847E-08 
1058 21 -3.06E-02 7.16E-01 -6.6038E+02 1.3802E+01 -7.6796E-02 1.4222E-04 
1058 93 -3.40E-02 7.20E-01 -6.2255E+02 1.2271E+01 -6.3666E-02 1.1001E-04 
1058 1190 2.70E-01 1.15E+00 -4.1744E+02 1.8851E+00 -2.0287E-03 7.2605E-07 
1054 21 -4.20E-02 6.98E-01 -6.7991E+02 1.4214E+01 -7.9555E-02 1.4812E-04 
1054 93 -4.76E-02 7.03E-01 -6.3731E+02 1.2566E+01 -6.5545E-02 1.1383E-04 
1054 1190 2.64E-01 1.14E+00 -4.2017E+02 1.8964E+00 -2.0444E-03 7.3270E-07 
1188 21 -3.31E+00 3.29E+01 -7.3344E+03 1.5667E+02 -9.9426E-01 2.0732E-03 
1188 1951 -1.18E+01 4.04E+01 -3.1135E+03 -1.3878E+03 -1.6064E+02 -6.0727E+00 
1188 990 3.03E+00 3.33E+01 7.2107E+02 3.6779E+00 4.0670E-01 -1.6595E-02 
1190 233 -1.66E+01 6.46E+01 -3.1558E+03 1.0417E+01 -9.1398E-03 2.7125E-06 
1190 990 5.31E+00 6.00E+01 7.7086E+02 1 .8602E+01 -4.2332E-01 1.4197E-03 
1190 93 3.85E-01 5.86E+01 4.1896E+03 -8.0644E+01 5.4454E-01 -1.1173E-03 
835 722 3.82E-01 6.31E+01 -1.0265E+03 4.1715E-01 -1.3988E-05 2.9807E-10 
835 436 -4.19E+00 6.63E+01 1.5548E+02 4.7224E-01 1.1799E-04 -1.4230E-08 
835 17 -6.31E+00 8.02E+01 7.3972E+02 -1.0329E-02 2.4156E-04 -2.4650E-08 
764 659 1.46E+01 5.12E+02 5.8636E+04 -2.1189E+03 3.2695E+01 -1.3719E-01 
764 17 -2.25E+01 4.76E+02 -2.6122E+04 3.5857E+01 -7.9629E-03 6.7069E-07 
764 133 -1.73E+01 2.17E+02 -4.0964E+04 1.3585E+01 -9.0300E-04 2.1857E-08 
175 42 6.23E-05 1.30E-01 -9.2674E+00 1.4152E+00 -6.0123E-03 2.7398E-05 
175 764 -1.96E-02 9.35E-01 -2.0151E+02 2.5210E-02 -8.0957E-07 9.1205E-12 
175 133 -7.45E-02 1.19E+00 -1.8009E+02 5.4913E-02 -4.0219E-06 1.0026E-10 
722 371 -1.14E+01 1.09E+02 9.6896E+02 4.1943E+00 1.9786E-04 -2.4852E-08 
722 764 -2.12E+00 1.01E+02 4.3345E+04 -4.3520E+00 1.6171E-04 -1.7024E-09 
722 17 -1.86E+0Q 2.69E+02 1.2425E+04 -7.1589E+00 3.0489E-03 -2.8231E-07 
1205 371 -7.90E+00 1.41E+02 4.1626E+02 4.7066E+00 -6.3951E-05 1.2976E-08 
1205 17 3.35E*O0 2.62E+02 1.1941E+04 -6.8474E+00 2.9289E-03 -2.6961E-07 
1205 764 8.18E-01 1.11E+02 4.3395E+04 -4.3449E+00 1.6037E-04 -1.6793E-09 
371 129 7.50E-01 1.64E+01 4.7155E+02 4.4346E-01 2.3809E-04 -2.8246E-08 
371 722 1.99E+00 2.35E+01 1.4643E+02 1.5087E-01 4.7674E-06 -1.2077E-10 
371 53 6.31E-01 2.42E+01 4.8876E+02 3.9258E-01 2.1583E-04 -2.6161E-08 
328 334 3.47E-04 1.94E-04 -5.8755E-03 1.0000E+00 -1.5959E-09 1.5661E-13 
328 480 -2.68E-01 2.24E+01 -4.9303E+01 9.1234E-01 -2.5353E-05 3.7728E-10 
328 129 1.82E-01 2.07E+01 1 .9389E+03 -1.2982E+00 1.0086E-03 -1.1966E-07 
334 328 3.47E-04 1.94E-04 -5.8755E-03 1.0000E+00 -1.5959E-09 1. 5661 E- 13 
334 480 -2.68E-01 2.24E+01 -4.9303E+01 9.1234E-01 -2.5353E-05 3.7728E-10 
334 12 1.82E-01 2.07E+01 1 .9389E+03 -1.2982E+00 1.0086E-03 -1.1966E-07 
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Characteristic Relation 

Fac Fuel Flow/ Lpfp Spd = constant 

PID 1205 : Fac Fuel Flow 
PID 32 : Lpfp Spd 


Characteristic Curve Fit 

#1. PID 1205 * cl * PID 32 

#2. PID 32 = cl * PID 1205 


Characteristic Relation 

Fac LOX Flow/ Lpop Spd = constant 

PID 1212 : Fac LOX Flow 
PID 30 : Lpop Spd 


Characteristic Curve Fit 

#3. PID 1212 - cl * PID 30 

#4. PID 30 — cl * PID 1212 


Characteristic Relation 

Fac Fuel Flow/ Hpfp Spd = constant 

PID 1205 : Fac Fuel Flow 
PID 260 : Hpfp Spd 

Characteristic Curve Fit 

#5. PID 1205 = cl * PID 260 

#6. PID 260 - cl * PID 1205 


Characteristic Relation 

(Lpop Ds P - Eng Ox In P)/ (Lpop Spd) A 2 = constant 


PID 

209 

: Lpop Ds P 




PID 

858 

: Eng Ox In P 




PID 

30 

: Lpop Spd 

- 



Characteristic Curve Fit 




#7. 

PID 

209 - cl * PID 

858 + 

c2 * PID 

30 A 2 

<8. 

PID 

858 = cl * PID 

209 + 

C2 * PID 

30 A 2 

#9. 

PID 

30 A 2 ® cl * PID 

209 

+ c2 * PID 

835 

. . 


Characteristic Equations (Page 1 of 3) 
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Characteristic Relation 

(Hpfp In P - Eng Fuel In P)/ (Lpfp Spd) A 2 = constant 

PID 203 : Hpfp In P 

PID 819 : Eng Fuel In P 

PID 32 : Lpfp Spd 


Characteristic curve Fit 


#10. 

PID 

203 = 

cl * PID 

819 + c2 * PID 

32 A 2 

#11. 

PID 

819 = 

cl * PID 

203 + c2 * PID 

32 A 2 

#12. 

PID 

32 A 2 « 

= Cl * PID 

203 + c2 * PID 

819 


Characteristic Relation 

(Hpfp Ds P - Hpfp In P)/ (Hpfp Spd) A 2 » constant 

PID 52 : Hpfp Ds P 

PID 203 : Hpfp In P 

PID 260 : Hpfp Spd 


Characteristic Curve Fit 


#13. 

PID 

52 = 

cl * 

PID 

203 + 

c2 * 

PID 

260 A 2 

#14. 

PID 

203 = 

cl * 

PID 

52 + 

c2 * 

PID 

260 A 2 

#15. 

PID 

260 A 2 

= cl 

* PID 

52 

+ c2 

* PID 

203 


Characteristic Relation 

(Hpop Ds P - Mcc Pc)/ (Fac LOX Flow) A 2 = constant 

PID 90 : Hpop Ds P 

PID 129 : Mcc Pc 
PID 1212 : Fac LOX Flow 


Characteristic Curve Fit 


#16. 

PID 

90 * 

cl * 

PID 

129 + 

c2 

* 

PID 

1212 A 2 

#17. 

PID 

129 - 

cl * 

PID 

90 + 

c2 

★ 

PID 

1212 A 2 

#18. 

PID 

1212 A 2 

= cl 

* PID 

129 

+ 

c2 

* PID 

90 


Characteristic Equations (Page 2 of 3) 
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Characteristic Relation 

(Mcc Cool Ds P - Lpft In P)/ (Lpfp Spd) A 2 = constant 

PID 17 : Mcc Cool Ds P 

PID 436 : Lpft In P 

PID 32 : Lpfp Spd 


Characteristic Curve Fit 


#19. 

PID 

17 = 

cl * 

PID 

436 + 

C2 * 

PID 

32 A 2 

#20. 

PID 

436 = 

cl * 

PID 

17 + 

c2 * 

PID 

32 A 2 

#21. 

PID 

32 A 2 

= cl 

* PID 

17 

+ c2 

* PID 

436 


Characteristic Relation 

(Hpop Ds P - Lpop Ds P)/ (Lpop Spd) A 2 = constant 

PID 90 : Hpop Ds P 

PID 209 : Lpop Ds P 

PID 30 : Lpop Spd 


Characteristic Curve Fit 


#22. 

PID 

90 = 

cl * 

PID 

209 + 

C2 * 

PID 

30 A 2 

#23. 

PID 

209 = 

Cl * 

PID 

90 + 

c2 * 

PID 

30 A 2 

#24. 

PID 

30 A 2 

= cl 

* PID 

90 

+ c2 

* PID 

209 


Characteristic Equations (Page 3 of 3) 
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Characteristic Curve Fit 


PID 1205 = cl * PID 32 
R.Mean R. Sigma Cl 
-2.01E+04 5.34E+02 2.2997E+00 

PID 32 - Cl * PID 1205 
R.Mean R. Sigma Cl 
8.88E+03 2.36E+02 4.2643E-01 

PID 1212 = Cl * PID 30 
R.Mean R. Sigma Cl 
-3.14E+03 1.04E+02 1.7452E+00 

PID 30 = Cl * PID 1212 
R.Mean R. Sigma Cl 
1.82E+03 5.99E+01 5.6952E-01 

PID 1205 = cl * PID 260 
R.Mean R. Sigma Cl 
-9.52E+03 1.77E+02 7.2141E-01 

PID 260 = Cl * PID 1205 
R.Mean R. Sigma Cl 
1.35E+04 2.42E+02 1.3679E+00 

PID 209 = Cl * PID 858 + C2 * PID 30 A 2 
R.Mean R. Sigma Cl C2 

1.30E+02 4.65E+00 8.8237E-01 5.5824E-06 

PID 858 - Cl * PID 209 + C2 * PID 30 A 2 
R.Mean R. Sigma Cl C2 

— 1.45E+02 5.24E+00 1.1241E+00 -6.2909E-06 

PID 30 A 2 - cl * PID 209 + c2 * PID 835 
R.Mean R. Sigma Cl C2 

-8.11E+05 8.18E+05 -1.5730E+04 1.0035E+04 

PID 203 = cl * PID 819 + c2 * PID 32 A 2 
R.Mean R. Sigma Cl C2 

1.20E+02 5.99E+00 8.1231E-01 4.0383E-07 

PID 819 = cl * PID 203 + C2 * PID 32 A 2 
R.Mean R. Sigma Cl C2 

-8.49E+01 4.86E+00 8.2134E-01 -3.7517E-07 

PID 32 A 2 - Cl * PID 203 + c2 * PID 819 
R.Mean R. Sigma Cl C2 

-2.29E+08 1.22E+07 2.1677E+06 -1.9919E+06 
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Characteristic Curve Fit 


PID 52 « cl * PID 203 + c2 * PID 260 A 2 
R.Mean R. Sigma Cl C2 

-1.04E+02 8.64E+01 3.8817E+00 4.3224E-06 

PID 203 * Cl * PID 52 + C2 * PID 260 A 2 
R.Mean R. Sigma Cl C2 

1.17E+02 1.23E+01 1.1268E-01 -4.6910E-07 

PID 260 A 2 = Cl * PID 52 + c2 * PID 203 
R.Mean R. Sigma Cl C2 

-7.46E+06 1.85E+07 2.2549E+05 -6.0593E+05 

PID 90 = cl * PID 129 + c2 * PID 1212 A 2 
R.Mean R. Sigma Cl C2 

-3.09E+02 1.46E+01 1.2849E+00 1.0587E-05 

PID 129 - cl * PID 90 + c2 * PID 1212 A 2 
R.Mean R. Sigma Cl C2 

2.97E+02 1.15E+01 7.3620E-01 -4.9742E-06 

PID 1212 A 2 = cl * PID 129 + c2 * PID 90 
R.Mean R. Sigma Cl C2 

-7.90E+06 5.46E+05 -2.3705E+04 2.8726E+04 

PID 17 - cl * PID 436 + c2 * PID 32 A 2 
R.Mean R. Sigma Cl C2 

2.57E+01 4.66E+01 1.0444E+00 -6.7441E-07 

PID 436 - cl * PID 17 + C2 * PID 32 A 2 
R.Mean R. Sigma Cl C2 

-4.36E+01 4.53E+01 9.3310E-01 1.1698E-06 

PID 32 A 2 - cl * PID 17 + c2 * PID 436 
R.Mean R. Sigma Cl C2 

4.74E+07 5.61E+06 -2.7127E+03 4.7162E+04 

PID 90 = cl * PID 209 + c2 * PID 30 A 2 
R.Mean R. Sigma Cl C2 

-1.10E+02 8.62E+01 9.6030E-01 1.4262E-04 

PID 209 - cl * PID 90 + c2 * PID 30 A 2 
R.Mean R. Sigma Cl C2 

1.68E+02 5.89E+01 6.7809E-01 -9.5686E-05 

PID 30 A 2 - cl * PID 90 + C2 * PID 209 
R.Mean R. Sigma Cl C2 

8.03E+05 6.04E405 6.9911E+03 -6.5952E+03 


70 



REPORT DOCUMENTATION PAGE 

Form Approved 
OMBNo . . 0704-0188 

Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, 
gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this 
collection of information, including suggestions for reducing this burden, to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson 
Davis Highway, Suite 1204, Arlington. VA 22202-4302, and to the Office of Management and Budget, Paperwork Reduction Project (0704-0188), Washington, DC 20503. 

1. AGENCY USE ONLY (Leave blank) 

2. REPORT DATE 

April 1994 

3. REPORT TYPE AND DATES COVERED 

Final Contractor Report 

4. TITLE AND SUBTITLE 



5. FUNDING NUMBERS 

Real-Time Sensor Data Validation 


Tirr t cO/i m i i 

6. AUTHOR(S) 

Timothy W. Bickmore 

WU— 584— 1)3— 11 
C-NAS3-25883 

7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 
GenCorp 

Aerojet Propulsion Division 
P.O. Box 13222 

Sacramento, California 95813-6000 

8. PERFORMING ORGANIZATION 
REPORT NUMBER 

E-8672 

9. SPONSORING/MONITORING AGENCY NAME(S) AND ADDRESS(ES) 

National Aeronautics and Space Administration 
Lewis Research Center 
Cleveland, Ohio 44135-3191 

10. SPONSOR ING/MONITO RING 
AGENCY REPORT NUMBER 

NASA CR- 195295 

11. SUPPLEMENTARY NOTES 

Technical Manager, Claudia M. Meyer, NYMA, Inc., Engineering Services Division, Brook Park, Ohio 44142. 
Project Manager, James W. Gauntner, Space Propulsion Technology Division, organization code 5310, NASA Lewis 
Research Center, (216) 433-7435. 

12a. DISTRIBUTION/AVAILABILITY STATEMENT 

12b. DISTRIBUTION CODE 


Unclassified - Unlimited 
Subject Categories 15, 16, and 20 


13. ABSTRACT (Maximum 200 words) 

This report describes the status of an on-going effort to develop software capable of detecting sensor failures on rocket 
engines in real time. This software could be used in a rocket engine controller to prevent the erroneous shutdown of an 
engine due to sensor failures which would otherwise be interpreted as engine failures by the control software. The 
approach taken combines analytical redundancy with Bayesian belief networks to provide a solution which has well- 
defined real-time characteristics and well-defined error rates. Analytical redundancy is a technique in which a sensor’s 
value is predicted by using values from other sensors and known or empirically derived mathematical relations. A set 
of sensors and a set of relations among them form a network of cross-checks which can be used to periodically validate 
all of the sensors in the network. Bayesian belief networks provide a method of determining if each of the sensors in 
the network is valid, given the results of the cross-checks. This approach has been successfully demonstrated on the 
Technology Test Bed Engine at the NASA Marshall Space Right Center. Current efforts are focused on extending the 
system to provide a validation capability for 100 sensors on the Space Shuttle Main Engine. 


14. SUBJECT TERMS 

Space Shuttle Main Engine; Sensors; Algorithms; Bayes Theorem; Probability theory; 
Mathematical models; Real-time operation 

15. NUMBER OF PAGES 

74 

16. PRICE CODE 

A04 

17. SECURITY CLASSIFICATION 
OF REPORT 

Unclassified 

18. SECURITY CLASSIFICATION 
OF THIS PAGE 

Unclassified 

19. SECURITY CLASSIFICATION 
OF ABSTRACT 

Unclassified 

20. LIMITATION OF ABSTRACT 


NSN 7540-01-280-5500 Standard Form 298 (Rev. 2-89) 


Prescribed by ANSI Std. Z39-18 
298-102 



















T 3 

o 


y o 


CD eg. 
H c? 2. 

2 -O 

> ° £ 

CD ^ §* 

m < S 

3 ff * 


Q. u 
© O 

f ° 

I 

© 


D 

© 

| 

I 

c 

5 


ssr 

1 SSL 

— 0(0 

® 033 

Q. S ® 

- 2 co 

oS-g 

X 1 i 

iip 

Q. (0 


CO 

cn 

i 

CO 

CO 


cp 2 
» 2 
S§ 

£“ 

|t 

2 . 3 
a 2 

3 c 

o" o 

5 » 


S. © 



